refactor(pending-store): spend a claim by deleting it

A live claim is now the whole record: the file exists means the human has not
filled it yet. That removes the status field, `filled_at`, the TTL field (the
store already computes the remainder from `expires_at`) and the filled-claim
retention window.

`consume()` replaces `mark_filled()`: it deletes the file and returns what it
removed, so a caller can only spend a claim once and a second attempt reports
what the CLI says out loud — no claim matches.
