Function hold 

pub fn hold(
    path: &Path,
    category: Category,
    bytes: u64,
    retention: Duration,
    registry_path: Option<&Path>,
) -> Result<QuarantineEntry>

Moves a validated artifact into a hidden adjacent safety hold and records it.

The move does not reclaim disk space until the hold is purged.

Errors

Returns an error if the path is not a real directory, cannot be moved atomically, or the registry cannot be updated. A failed registry update attempts to restore the original path.