Drop garbage uploads early (D42)

Random-named uploads that never get a real name or password were ~90% of
what seeding stores. Two filters:

- before storing (seeding, ingest): random-named uploads of a dropped
  signature (posting tool from the Message-ID, first group) or of a
  release dropped after its probe aren't stored; 2% of a dropped
  signature's releases are still kept and probed. Stored files of dropped
  signatures aren't probed.
- after a probe: a random-named release that is still unnamed, without
  password, names from files or spot, with all its probes done, and
  encrypted, a container or missing its first article, is deleted and
  tombstoned in dropped_releases.

Signatures are learned by gc:scheduler from a sample of probed releases
(signature_probes); garbage:learn --seed fills it from existing files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

start/env.ts

@@ -108,6 +108,9 @@ export default await Env.create(new URL('../', import.meta.url), {
   GC_AWAIT_INSPECTION_SECONDS: Env.schema.number.optional(),
   GC_MERGE_INTERVAL_MS: Env.schema.number.optional(),
   INSPECTION_FEED_MAX: Env.schema.number.optional(),
+  GARBAGE_FILTER: Env.schema.boolean.optional(),
+  GARBAGE_EXPLORE_PERCENT: Env.schema.number.optional(),
+  GARBAGE_LEARN_INTERVAL_MS: Env.schema.number.optional(),
   ARCHIVE_WALK_MAX_SEGMENTS: Env.schema.number.optional(),
   DEFERRED_SETTLE_MS: Env.schema.number.optional(),
   DEFERRED_EXPAND_MAX_PARTS: Env.schema.number.optional(),