Owner decision (q91): delete the existing pre-upgrade key-log-only proxy run dirs?

[Juliusolsson05]

Owner decision needed (q91): delete the TLS key logs that already exist in key-log-only proxy run dirs?

Background:

• security(debug-retention): existing TLS key logs in key-log-only proxy run dirs are never cleaned up #1385's fix (fix(debug-retention): collect key-log-only proxy run dirs from new runs only; existing key logs untouched #1388) collects key-log-only run dirs made AFTER a build containing it first starts; see fix(debug-retention): collect key-log-only proxy run dirs from new runs only; existing key logs untouched #1388 for the baseline design.
• It deliberately leaves every EXISTING key-log-only dir untouched, because deleting them is this decision.
• On the owner's machine that is 23 dirs, 5,177,529 bytes of plaintext TLS session secrets, dated May–September 2026 (claude proxy: sslkeylog.log grows unbounded in every live run dir (and holds TLS secrets on disk) #1380 review c recounted names and sizes only; contents never read).

Options:

• Yes: a one-time sweep of the baselined key-log-only dirs, for example by clearing the baseline so they fall under the normal TTL pass.
• No: keep them indefinitely; they are outside every retention pass.

Why it matters: nothing reads these files, and they decrypt captured traffic. W2 recommends yes.

This issue exists so the decision keeps a tracker once #1385 is closed by #1388 (#1388 review c).