Remove baseline entries that no longer match any finding

[tauanbinato]

Problem

A baseline entry whose code changed, or was removed, stays in jevgate-baseline.json forever. It matches no finding any more, but the only way to drop it is to rewrite the whole baseline with jevgate baseline (without mark). That also re-accepts every current finding wholesale, which projects forbid: in Nodehaven, agents may dismiss findings only one at a time with baseline mark.

Seen on 2026-10-04 in Nodehaven PR #177. Two intended dismissals (SkillDetail.tsx:326, WeaponSkills.tsx:98) were fixed in the code by sharing a component. Their entries now match nothing, but they stay in the baseline, still count in baseline stats, and keep showing in the baseline's diff. Earlier, in #181, a stale entry (71658f5d, validCreature before it was split) had to be removed by hand-editing the JSON.

Proposal

A command that removes only entries that match no finding, for example jevgate baseline prune (or baseline mark --remove-stale):

• It works from the last complete check (.jevgate/latest.json), like mark. It refuses after a partial or --base check, unless the entries' files were all covered, so it never drops entries for code the check didn't see.
• It removes only the entries no finding matched, through any fingerprint (v1, v2 or a rename alias, once Keep fingerprints stable across merges, selections and renames #59 lands). It never adds or re-accepts anything.
• It prints each removed entry (reason, rule, path:line, fingerprint, note), and --dry-run lists them without writing.
• The hooks and the baseline guard count it as removing acceptances, never as accepting findings.

Done when

On a repository where an accepted finding's code was fixed, a complete check followed by the command removes exactly that entry. The command leaves every matched entry with its reason and note. A --base check refuses unless the entry's file was covered. Tests protect each of these.