Add mlf unpublish command

Deletes every lexicon the workspace published, using the lol.mlf.package manifest as the list of NSIDs — so we never guess which records on the PDS belong to this workspace. Refuses to proceed if no manifest exists. After record deletes, the manifest record itself is removed. Interactive confirmation by default; --yes skips. Each deleteRecord is idempotent (already-gone records are logged and skipped). Records whose NSID isn't a descendant of [package].name are skipped even if they appear in the manifest — guards against a hand-edited manifest that names foreign NSIDs. DNS TXT records are intentionally left in place so re-publishing doesn't require re-provisioning DNS.