v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

Image retention: after a done/undone guarded Update and at remove, an app's images older than its running
and previous one are deleted — never an image any container, installed compose or installed/previous record
names (box-wide keep set read at delete time); exact id, never forced or pruned; paused while any update runs;
a one-time sweep of catalog app images at the first start. Install hold: an after_install app is installed
behind the setup gate's door and opens when after_install succeeds or the household says it changed the login.
Tests TestImageRetention_* and TestInstallHold_* with red-proofs; parity fixture for the held card.

MinAgent: 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/main.go

@@ -1687,6 +1687,16 @@ func main() {
 	// v0.280.0 (`09` §3 decision 46): the setup gate's loop — every closed gate's traefik file exists, a probe
 	// that says "set up" opens its gate, and a gate file nobody owns is removed.
 	go stackMgr.RunSetupGateLoop(ctx, 20*time.Second)
+	// decision 53 (R-736): the one-time image clean-up for a box older than the rule — after the first catalog sync
+	// has had time to land (it reads the catalog's image names), once per box (a marker file).
+	go func() {
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(3 * time.Minute):
+		}
+		stackMgr.RunImageRetentionOnce()
+	}()
 
 	// --- Initialize API router ---
 	apiRouter := api.NewRouter(cfg, *configPath, sett, stackMgr, syncer, cpuCollector, backupMgr, metricsStore, updater, notifier, logger)