v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

Image retention: after a done/undone guarded Update and at remove, an app's images older than its running
and previous one are deleted — never an image any container, installed compose or installed/previous record
names (box-wide keep set read at delete time); exact id, never forced or pruned; paused while any update runs;
a one-time sweep of catalog app images at the first start. Install hold: an after_install app is installed
behind the setup gate's door and opens when after_install succeeds or the household says it changed the login.
Tests TestImageRetention_* and TestInstallHold_* with red-proofs; parity fixture for the held card.

MinAgent: 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -7,7 +7,12 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-09-30 (v0.283.0 + v0.283.1 — apps off-site by default, Stop holds during a backup)
+Last updated: 2026-09-30 late evening (v0.284.0 — image retention, the install hold)
+
+> **2026-09-30 late — v0.284.0.** Operator rulings: `09` §3 decision 53 (R-736 A: keep running + previous image per
+> service, delete older, never an image a container/compose/record names) → `stacks/image_retention.go`, with a
+> one-time sweep at start; R-741 → `stacks/install_hold.go` (after_install apps held behind the gate's door until the
+> login is replaced). Decision 52 (same-tag re-tests) needed NO controller change (measured by a unit walk).
 
 > **2026-09-30 — v0.283.0 / v0.283.1.** Decision 50: `settings.DefaultOffboxOnForNewApp` from the deploy-done hook
 > (an earlier per-app choice wins); one press for older apps; `backup/offbox_fit.go` size card (estimate at each run