ops(docker): prune unused cache on deploys and nightly

Add scripts/docker-prune.sh (build cache >72h capped at 4g, unreferenced images >7d, stopped containers >24h; never volumes), run it after every CI deploy and compose update, and schedule a nightly prune from the host-side jobs-worker. Tighten the deployment contract tests to assert the scoped-prune boundaries.

scripts/ci-deploy.sh

@@ -193,5 +193,6 @@ while IFS= read -r tag; do
     if [ -n "$tagged_image" ] && [ "$tagged_image" != "$previous_image" ]; then docker image rm "$tag" || true; fi
   fi
 done < <(docker image ls --format '{{.Repository}}:{{.Tag}}' epicnext-cms)
-docker builder prune -af --filter "until=72h" --max-used-space=4g || true
-docker image prune -f --filter "until=168h" || true
+# Reclaim build cache, unreferenced images and long-stopped containers. Never
+# volumes; retention boundaries are enforced inside docker-prune.sh.
+bash "$deploy_dir/scripts/docker-prune.sh" || true