ci(image): clean up after the image build and the deploy

The build job runs docker on the runner host's daemon, so every run left
two tagged images behind for good. Remove this run's tags once they are
pushed and cap BuildKit's cache at 5 GB, always, never failing the job.

The deploy drops the dangling image its pull replaced on the rgcom host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

.gitea/workflows/build-image.yml

@@ -157,6 +157,21 @@ jobs:
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:${TAG}"
 
+      - name: Remove this run's image and cap the build cache
+        # The build runs on the HOST daemon, so whatever it leaves stays on the
+        # runner host for good: every run used to leave two tagged images, and
+        # each newer `latest` turned the previous one into a permanent `sha-` image
+        # until the host ran out of disk. Both tags are in the registry by now, so
+        # the local copies are dead weight. BuildKit keeps its layer cache apart
+        # from the images, so the next build stays fast; the cache is pruned to a
+        # cap instead of growing forever (`--reserved-space` is the same flag's
+        # name on newer Docker). Runs even after a failure, and never fails the job.
+        if: always()
+        run: |
+          docker image rm "${IMAGE}:latest" "${IMAGE}:${TAG}" 2>/dev/null || true
+          docker builder prune -f --keep-storage 5GB \
+            || docker builder prune -f --reserved-space 5GB || true
+
       - name: Log out
         if: always()
         run: docker logout "${REGISTRY}" || true
@@ -207,3 +222,11 @@ jobs:
           echo "::error::The site did not become healthy within 150s."
           docker compose logs --tail 100 site
           exit 1
+
+      - name: Remove the image this deploy replaced
+        # The pull moves `latest` to the new image and leaves the old one untagged
+        # on the host. Untagged images are never used again (a rollback pulls a
+        # `sha-` tag from the registry), so drop them. Dangling images only: nothing
+        # tagged and nothing a container is using is touched.
+        if: always()
+        run: docker image prune -f || true