ops(docker): prune unused cache on deploys and nightly

Add scripts/docker-prune.sh (build cache >72h capped at 4g, unreferenced images >7d, stopped containers >24h; never volumes), run it after every CI deploy and compose update, and schedule a nightly prune from the host-side jobs-worker. Tighten the deployment contract tests to assert the scoped-prune boundaries.

scripts/docker-update.sh

@@ -150,3 +150,7 @@ done
 printf '%s\n' "${kept[@]}" "${pending[@]}" > "$history.tmp"
 mv "$history.tmp" "$history"
 log "Keeping the two latest releases; in-use images and persistent volumes are preserved."
+# Reclaim build cache + unreferenced images + long-stopped containers only;
+# the scoped retention is enforced inside docker-prune.sh (never volumes).
+bash "$DIR/scripts/docker-prune.sh" >>"$LOG_FILE" 2>&1 || log "Docker prune reported an error (see $LOG_FILE)"
+log "Pruned unused Docker cache."