feat(evidence): add safe retention and materialized reads

harness/tests/test_preprocess_cli.py

@@ -54,3 +54,17 @@ def test_preprocess_resume_rejects_generation_id_before_configuration(monkeypatc
         "status": "failed", "error": "resume requires a preprocessing run id"
     }
     assert called is False
+
+
+def test_preprocess_evidence_gc_json_is_pristine(monkeypatch, tmp_path):
+    import tht.cli.preprocess_cmd as command
+
+    monkeypatch.setattr(command, "gc_from_config", lambda *a, **k: {
+        "status": "succeeded", "dry_run": True, "evicted": [], "failures": [],
+    })
+    response = CliRunner().invoke(
+        app, ["preprocess", "evidence", "gc", "--dry-run", "--json", "-c",
+              str(tmp_path / "workspace.yaml")]
+    )
+    assert response.exit_code == 0, response.output
+    assert json.loads(response.output)["dry_run"] is True