ops(docker): prune unused cache on deploys and nightly

Add scripts/docker-prune.sh (build cache >72h capped at 4g, unreferenced images >7d, stopped containers >24h; never volumes), run it after every CI deploy and compose update, and schedule a nightly prune from the host-side jobs-worker. Tighten the deployment contract tests to assert the scoped-prune boundaries.

scripts/jobs-worker.ts

@@ -232,6 +232,38 @@ async function cleanupOldSessions(): Promise<void> {
 	}
 }
 
+/** Host-side: reclaim Docker's unused cache (build cache, unreferenced images,
+ * stopped containers). Volumes and in-use images are never touched. No-op when
+ * docker or the prune script is unavailable. */
+async function pruneDockerCache(): Promise<void> {
+	const { access } = await import("node:fs/promises");
+	const { resolve } = await import("node:path");
+	const { spawn } = await import("node:child_process");
+	const script = resolve(process.cwd(), "scripts", "docker-prune.sh");
+	try {
+		await access(script);
+	} catch {
+		return;
+	}
+	await new Promise<void>((resolvePromise) => {
+		const child = spawn("bash", [script], { stdio: "ignore" });
+		child.on("error", (err) =>
+			captureWorkerError(
+				err,
+				"Docker prune could not start (is bash on PATH?)",
+			),
+		);
+		child.on("close", (code) => {
+			if (code !== 0)
+				captureWorkerError(
+					new Error(`docker-prune.sh exited ${code}`),
+					"Docker prune failed",
+				);
+			resolvePromise();
+		});
+	});
+}
+
 async function publishScheduledArticles(): Promise<void> {
 	try {
 		const now = new Date();
@@ -305,6 +337,15 @@ async function main() {
 	});
 	logger.info("Scheduled: old data cleanup (daily 04:00)", { module: "jobs" });
 
+	new Cron("0 5 * * *", () => {
+		pruneDockerCache().catch((e) =>
+			captureWorkerError(e, "Docker prune error"),
+		);
+	});
+	logger.info("Scheduled: Docker cache prune (daily 05:00)", {
+		module: "jobs",
+	});
+
 	new Cron("*/5 * * * *", () => {
 		checkOpsHealth().catch((e) => captureWorkerError(e, "Health check error"));
 	});