#1749 data prune still misclassifies live records as orphans on 20260820 (after #1396) — serve-minted token/grant records, and report data of every live workflow

In an operator clone of a namespace shared with a hub running swamp serve, swamp data prune --dry-run on 20260820.072114.0-sha.05d20b6a (postdates the #1396 fix) still offers to reclaim live records — 13 models, 25 data entries, 175 versions. Two distinct false-positive classes:

1. Serve-side control-plane records. Two swamp/server-token models (the currently-valid operator token among them — verified live against the serve) and one swamp/grant. These were minted serve-side; their definitions are evidently not among what the client-side liveness scan resolves, so their data scans as ownerless — the same class of gap #1396 fixed for local-vs-datastore path resolution, one tier further out.

2. Report data of live workflows. The reclaim list includes five workflows whose YAML definitions are present in workflows/ and returned by swamp workflow search in the same clone at the same moment — two of them on active schedule triggers. Their report-swamp-workflow-summary data is classified orphaned, so pruning would delete the run history of every live workflow.

Environment: @swamp/s3-datastore on OVH S3, one namespace shared between the hub's serve and operator CLI clones. First observed 2026-08-18 on 20260817.010424.0-sha.21133ea1; re-verified today on 20260820.072114.0-sha.05d20b6a.

Expected: prune's orphan determination should resolve definitions against everything that can own records in the namespace — at minimum, treat serve-side control-plane types (swamp/server-token, swamp/grant) as never orphaned from a client-side scan, and consult workflow definitions before classifying their report data.

Impact: as in #1396, --dry-run previews the loss but does not prevent it, and --json implies skipping confirmation — a script or agent pruning what looks like ~84 KB of orphans in this topology deletes the serve's auth material and all live workflows' run history. We caught it on the dry run; no prune was executed.