image-builder: prune superseded images right after each push

A rebuild leaves the image it replaced untagged but still resident, which
is ~33G for sbo-full:current. Nothing reclaimed it until the daily 07:00
prune, so the next variant built on top of that dead weight.

That was enough to break the chain. Exporting a 33G image needs roughly
its own size again in transient space, and with the old cache floor the
volume was short at 03:20: build-full-image.sh failed ten nights running
(2026-09-13 through 09-22) with "no space left on device", always in the
same export/unpack phase. build-sbo-testbuild.sh then saw an unchanged
parent and skipped, correctly and silently, so the -current tags sat six
days stale while 15.0 kept rebuilding fine.

Prune at the point where the superseded image becomes dangling: after
the push, while the tag just pushed is the only thing referencing its
layers. `docker image prune -f` only removes untagged images, so the
chain's own tags are never at risk. Best-effort, since a failed prune
costs space, not correctness.

bootstrap.sh is left alone: its images are ~150MB, so a superseded one
is noise next to the transient peak this addresses.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/image-builder/build-sbo-testbuild.sh b/image-builder/build-sbo-testbuild.sh
index 8d08a03..d40ccb1 100755
--- a/image-builder/build-sbo-testbuild.sh
+++ b/image-builder/build-sbo-testbuild.sh
@@ -135,6 +135,13 @@ DOCKERFILE
         _warn "  push failed for ${TB_TAG}."
         return 1
     fi
+
+    # Drop the image this rebuild superseded rather than leaving it resident
+    # until a daily prune; see the same step in build-full-image.sh for why
+    # that mattered. Best-effort: a failed prune costs space, not correctness.
+    _log "  Pruning superseded images..."
+    docker image prune -f >/dev/null 2>&1 || _warn "  image prune failed (ignored)"
+
     _log "=== Done: ${TB_TAG} ==="
 }