Add dotsec rm (remove an engagement)

[Dxsk]

Summary

dotsec rm <target> [--archive] — the destructive counterpart to new/archive/stop.

• Guards: valid target name (^[a-zA-Z0-9._-]+$, blocks //..), existing workspace, [y/N] confirmation (EOF-safe).
• --archive tar.gz's the workspace first (via cmd_archive).
• Stops containers (mitmproxy-<t>, oob-<t>) + kills the Exegol tmux session.
• Removes the workspace: host rm -rf first, then a throwaway container (docker run --rm … alpine rm -rf) for the root-owned proxy certs (no sudo); falls back to a sudo rm -rf hint if anything remains.
• Router (rm/remove), usage, completions.

Test Plan

• make test — 59/59 (3 new: abort keeps workspace, confirm removes it, invalid name refused; via docker stub + host rm)
• make lint — shellcheck clean
• Manual: dotsec rm acme on a real engagement with root-owned proxy certs → container-fallback wipes them