image-builder: prune superseded images right after each push

A rebuild leaves the image it replaced untagged but still resident, which
is ~33G for sbo-full:current. Nothing reclaimed it until the daily 07:00
prune, so the next variant built on top of that dead weight.

That was enough to break the chain. Exporting a 33G image needs roughly
its own size again in transient space, and with the old cache floor the
volume was short at 03:20: build-full-image.sh failed ten nights running
(2026-09-13 through 09-22) with "no space left on device", always in the
same export/unpack phase. build-sbo-testbuild.sh then saw an unchanged
parent and skipped, correctly and silently, so the -current tags sat six
days stale while 15.0 kept rebuilding fine.

Prune at the point where the superseded image becomes dangling: after
the push, while the tag just pushed is the only thing referencing its
layers. `docker image prune -f` only removes untagged images, so the
chain's own tags are never at risk. Best-effort, since a failed prune
costs space, not correctness.

bootstrap.sh is left alone: its images are ~150MB, so a superseded one
is noise next to the transient peak this addresses.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions