fix: reconcile < target severity and rmtree symlink guard (v0.5.10)

- reconcile.py: re-escalate the < target branch from INFO to WARNING and
  add 'permanently unmapped' label. Both post-loop branches produce identical
  permanent mapping loss; v0.5.9 incorrectly treated the timeout case as
  recoverable.

- executor.py: guard shutil.rmtree with 'not os.path.islink(person_dir)'
  so a race-replaced symlink-to-directory is skipped rather than raising
  an unhandled OSError that aborts all remaining jobs. Correct comment:
  rmtree raises OSError, not NotADirectoryError.

winnow/executor.py

@@ -107,9 +107,10 @@ def execute_jobs(jobs: list[dict]) -> None:
                 logger.error(str(e))
                 continue
             # Face crops are transient (uploaded then discarded); wipe before each run.
-            # shutil.rmtree raises NotADirectoryError on a top-level symlink (POSIX),
-            # so a race-replaced symlink cannot cause deletion outside output_dir.
-            if os.path.isdir(person_dir):
+            # Exclude symlinks explicitly: os.path.isdir follows them and returns True
+            # for a symlink-to-directory, but shutil.rmtree raises OSError on a
+            # top-level symlink rather than deleting through it.
+            if os.path.isdir(person_dir) and not os.path.islink(person_dir):
                 shutil.rmtree(person_dir)
             os.makedirs(person_dir, exist_ok=True)