v0.351.0 (unreleased): old -rc controller images and old infra images are deleted (decision 56 amended, decision 285)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -2244,10 +2244,16 @@ that folder is never a dead end, and an install never runs into it silently (R-6
 - **Controller image retention (v0.285.0, decision 56)** — 3 minutes after every start the box keeps the controller
   image it runs and the one before it (the swap record `update-state.json` `previous_image` of a swap that ended on the
   running version; without one, the highest version below the running one), every version above the running one (a
-  pulled target) and every non-version tag (`latest`, `-rc`); older and untagged controller images are deleted by exact
+  pulled target) and every non-version tag (`latest`); since v0.351.0 a test build (`X.Y.Z-rc.N`) is a version below its
+  release, so an old one goes too, and the fallback previous prefers a release; older and untagged controller images are deleted by exact
   name/ID after the in-use check. Nothing while the controller swaps itself; registry tags are never touched. The
   agent's own roll-back needs only the running image (it restores what `/etc/felhom-controller-image` named when the
   swap began). See `internal/stacks/controller_image_retention.go`.
+- **Infrastructure image retention (v0.351.0, decision 285)** — in the same start-up pass, for each pinned infra image
+  (`infra.Images()`: traefik, cloudflared, FileBrowser, Samba) the box keeps the pin, every newer version, the highest
+  version below the pin (the previous pin) and every image a container uses; older and untagged images of that
+  repository are deleted by exact name/ID. Non-version tags stay. Skipped while an app pulls (R-863, retried every 2
+  minutes) or while the controller swaps itself. See `internal/stacks/infra_image_retention.go`.
 - **The setup gate (v0.280.0, decision 46)** — `.felhom.yml` `setup_gate: true` + optional `setup_done_probe: {url, field,
   done}`. A FRESH install is closed to everyone but the household: the traefik file
   `<stacks>/traefik/dynamic/setup-gate-<app>.yml` is written BEFORE the first start (a failed write refuses the install) and