Wire post-audit cleanup into promotion workflow and document history maintenance

- docs/audit-workflow.md: add full reference for cleanup, restore, and purge scripts including usage examples and protected paths
- prepare-audit-promotions.mjs: invoke runCleanup after artifact generation with aggressive scope; warns and continues on failure

docs/audit-workflow.md

@@ -119,6 +119,76 @@ The command reads approved rows from `selection-manifest.tsv` and writes:
 - `staging-notes/` for approved rows that still need manual design work
 - `promotion-summary.md` to summarize what was generated
 
+After promotion preparation completes, aggressive cleanup runs automatically.
+The cleanup step quarantines historical Copilot chat/session artifacts and older
+audit runs up to the completion boundary, then writes `cleanup-summary.md` in
+the same audit directory.
+
+Manual cleanup command:
+
+```bash
+resources/scripts/cleanup-copilot-history.sh --audit-dir .local/audits/<machine-id>/<timestamp>
+```
+
+Execute mode (applies changes instead of dry-run):
+
+```bash
+resources/scripts/cleanup-copilot-history.sh --audit-dir .local/audits/<machine-id>/<timestamp> --execute
+```
+
+Cleanup quarantines data under:
+
+```text
+~/.copilot-resources-state/quarantine/copilot-history-cleanup/
+```
+
+Restore the latest quarantine run in dry-run mode:
+
+```bash
+resources/scripts/restore-copilot-history.sh
+```
+
+Restore a specific quarantine run:
+
+```bash
+resources/scripts/restore-copilot-history.sh --quarantine-run ~/.copilot-resources-state/quarantine/copilot-history-cleanup/<timestamp> --execute
+```
+
+Restore only matching paths:
+
+```bash
+resources/scripts/restore-copilot-history.sh --filter workspaceStorage/483a18cf047eff8026d789521f5879e3 --execute
+```
+
+Restore one exact original path:
+
+```bash
+resources/scripts/restore-copilot-history.sh --path "/Users/<you>/Library/Application Support/Code/User/workspaceStorage/<id>/chatSessions" --execute
+```
+
+The restore command skips destinations that already exist unless `--overwrite`
+is passed.
+
+Hard-purge old quarantine runs in dry-run mode:
+
+```bash
+resources/scripts/purge-copilot-history-quarantine.sh --before 2026-05-24T00:00:00Z
+```
+
+Execute purge while keeping the newest quarantine run:
+
+```bash
+resources/scripts/purge-copilot-history-quarantine.sh --before 2026-05-24T00:00:00Z --keep-latest 1 --execute
+```
+
+Protected paths are never cleanup targets, including:
+
+- `~/.copilot-resources`
+- `~/.copilot/*` symlink targets
+- `~/.copilot-resources-state/publish-log.tsv`
+- `~/.copilot-resources-state/project-ports-registry.json`
+- repository source files under `resources/`, `docs/`, and `templates/`
+
 ## Limits
 
 - This audits persisted local artifacts only.