Protect pending outputs from destructive bundle rebuilds

[stefanvictora]

What to build

Prevent local review work from being deleted accidentally when users clean or rebuild the review bundle. Pending agent output should be treated as user work, not disposable cache.

Acceptance criteria

• revpack clean refuses to remove .revpack/ when publishable outputs are pending.
• The refusal message summarizes the pending outputs that would be deleted.
• revpack clean --discard-outputs explicitly permits deleting the bundle and its outputs.
• revpack prepare --fresh refuses when publishable outputs are pending.
• revpack prepare --fresh --discard-outputs explicitly permits discarding pending outputs before rebuilding.
• Empty outputs do not block clean or fresh prepare.
• Behavior is covered by targeted CLI/workspace tests and documented in user-facing help or docs where relevant.
• The changelog describes the new protection for pending outputs.

Blocked by

None - can start immediately