Wire post-audit cleanup into promotion workflow and document history maintenance

- docs/audit-workflow.md: add full reference for cleanup, restore, and purge scripts including usage examples and protected paths
- prepare-audit-promotions.mjs: invoke runCleanup after artifact generation with aggressive scope; warns and continues on failure

docs/audit-workflow.md

@@ -119,6 +119,76 @@ The command reads approved rows from `selection-manifest.tsv` and writes:
 - `staging-notes/` for approved rows that still need manual design work
 - `promotion-summary.md` to summarize what was generated
 
+After promotion preparation completes, aggressive cleanup runs automatically.
+The cleanup step quarantines historical Copilot chat/session artifacts and older
+audit runs up to the completion boundary, then writes `cleanup-summary.md` in
+the same audit directory.
+
+Manual cleanup command:
+
+```bash
+resources/scripts/cleanup-copilot-history.sh --audit-dir .local/audits/<machine-id>/<timestamp>
+```
+
+Execute mode (applies changes instead of dry-run):
+
+```bash
+resources/scripts/cleanup-copilot-history.sh --audit-dir .local/audits/<machine-id>/<timestamp> --execute
+```
+
+Cleanup quarantines data under:
+
+```text
+~/.copilot-resources-state/quarantine/copilot-history-cleanup/
+```
+
+Restore the latest quarantine run in dry-run mode:
+
+```bash
+resources/scripts/restore-copilot-history.sh
+```
+
+Restore a specific quarantine run:
+
+```bash
+resources/scripts/restore-copilot-history.sh --quarantine-run ~/.copilot-resources-state/quarantine/copilot-history-cleanup/<timestamp> --execute
+```
+
+Restore only matching paths:
+
+```bash
+resources/scripts/restore-copilot-history.sh --filter workspaceStorage/483a18cf047eff8026d789521f5879e3 --execute
+```
+
+Restore one exact original path:
+
+```bash
+resources/scripts/restore-copilot-history.sh --path "/Users/<you>/Library/Application Support/Code/User/workspaceStorage/<id>/chatSessions" --execute
+```
+
+The restore command skips destinations that already exist unless `--overwrite`
+is passed.
+
+Hard-purge old quarantine runs in dry-run mode:
+
+```bash
+resources/scripts/purge-copilot-history-quarantine.sh --before 2026-05-24T00:00:00Z
+```
+
+Execute purge while keeping the newest quarantine run:
+
+```bash
+resources/scripts/purge-copilot-history-quarantine.sh --before 2026-05-24T00:00:00Z --keep-latest 1 --execute
+```
+
+Protected paths are never cleanup targets, including:
+
+- `~/.copilot-resources`
+- `~/.copilot/*` symlink targets
+- `~/.copilot-resources-state/publish-log.tsv`
+- `~/.copilot-resources-state/project-ports-registry.json`
+- repository source files under `resources/`, `docs/`, and `templates/`
+
 ## Limits
 
 - This audits persisted local artifacts only.

resources/scripts/prepare-audit-promotions.mjs

@@ -5,6 +5,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { runCleanup } from './cleanup-copilot-history.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -470,12 +471,35 @@ function main() {
   const generatedArtifacts = writeArtifacts(auditDir, approvedRows);
   const summaryPath = writeSummary(auditDir, manifestPath, approvedRows, generatedArtifacts);
 
+  let cleanupSummaryPath = '';
+  try {
+    const cleanupResult = runCleanup({
+      repoRoot: options.repoRoot,
+      auditDir,
+      completionCutoff: new Date().toISOString(),
+      scope: 'aggressive',
+      execute: true,
+      quarantineDir: path.join(
+        os.homedir(),
+        '.copilot-resources-state',
+        'quarantine',
+        'copilot-history-cleanup',
+      ),
+    });
+    cleanupSummaryPath = cleanupResult.summaryPath;
+  } catch (error) {
+    console.warn(`Post-audit cleanup failed: ${error?.message || String(error)}`);
+  }
+
   console.log('Audit promotion preparation complete.');
   console.log(`Audit directory: ${auditDir}`);
   console.log(`Approved rows: ${approvedRows.length}`);
   console.log(`Draft resources: ${generatedArtifacts.filter((artifact) => artifact.kind === 'draft').length}`);
   console.log(`Staging notes: ${generatedArtifacts.filter((artifact) => artifact.kind === 'note').length}`);
   console.log(`Summary: ${summaryPath}`);
+  if (cleanupSummaryPath) {
+    console.log(`Cleanup summary: ${cleanupSummaryPath}`);
+  }
 }
 
 main();