fix: cleanup step

[samrose]

1. Stale derived facts on load_rules
   The evaluator only adds facts, never removes them. When rules were reloaded (e.g. after retracting a base fact),
   old derived facts would persist. The fix clears all derived predicates before re-evaluating from scratch.

2. Incorrect incremental maintenance for negation and recursion
   The previous incremental derive/retract code was too naive:

• It didn't know about rules that negate a predicate — asserting a "banned" fact wouldn't trigger removal of
  "active" derived facts.
• Retraction with recursive rules couldn't be handled correctly by the per-rule compute_retractions path
  (transitive chains break it).

The fix introduces a tiered strategy:

• Pure positive, non-recursive assertions → fast incremental path with fixpoint iteration (derive_to_fixpoint)
• Anything involving negation or retraction → fall back to full_rederive (clear all derived facts + re-run the
  evaluator from base facts)

The tests cover the newly-fixed cases: deep transitive ancestor chains, retraction removing derived facts,
banning/unbanning with negation, and rule reloads clearing stale state.