Co-locate Keystore actor records for garbage collection

[chunter-cb]

Summary

• Pack actor config, policy manager, and policy commitment into one 4-aligned 3-word record (word0/word1/word2) so a later slot-grouping stem walk can reap expired leaves without an (account, actorId) preimage.
• Tag reap-eligible records with CLEANABLE (bit 248 of word0, last byte of the reserved region). Account-state keeps that byte zero, so a reaper can skip it. k1 self config stays inline and is not tagged.
• _reapRecord is internal and silent (no ActorPruned); it is not on the ABI yet. A random scan can be wired later.

Test plan

• forge test (401 passing locally, including CleanableLayoutTest)
• Confirm authorize still writes authenticator/expiry/scope on word0 and policy on word1/word2
• Confirm revoke zeros the whole record
• Confirm expired CLEANABLE records reap; live, no-expiry, and AccountState do not
• Confirm ActorConfig ABI / ActorAuthorized payload still omit the storage-only CLEANABLE bit