mapsize 1.2.0: permanent delete and in-map reveal when headless

On a headless Linux or BSD system (no DISPLAY or WAYLAND_DISPLAY) nothing
empties the freedesktop trash, so trashing never freed space. There, d now
deletes permanently after an explicit confirmation, checking owner and type
against the scan and removing through an os.Root on the parent so a swapped
symlink cannot redirect it. o shows the folder in the map instead of
launching a file manager. Desktop sessions, macOS and Windows are unchanged.

ARCHITECTURE.md

@@ -301,4 +301,7 @@ Filenames and snapshot contents are untrusted.
   Aggregates are recomputed with saturating arithmetic rather than trusted.
 * No shell is ever invoked. "Open/reveal" and trash use direct `exec` with
   argument vectors or native APIs; paths are passed as single arguments.
+* Permanent delete (headless only) checks the item's owner and type against
+  the scan and removes it through an `os.Root` on the parent directory, so
+  a symlink swapped in since the scan cannot redirect it.
 * `--read-only` disables every mutating action in the UI.