v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

Image retention: after a done/undone guarded Update and at remove, an app's images older than its running
and previous one are deleted — never an image any container, installed compose or installed/previous record
names (box-wide keep set read at delete time); exact id, never forced or pruned; paused while any update runs;
a one-time sweep of catalog app images at the first start. Install hold: an after_install app is installed
behind the setup gate's door and opens when after_install succeeds or the household says it changed the login.
Tests TestImageRetention_* and TestInstallHold_* with red-proofs; parity fixture for the held card.

MinAgent: 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/delete.go

@@ -285,6 +285,9 @@ func (m *Manager) DeleteStack(name string, removeHDDData bool) (*DeleteResponse,
 		}
 	}
 
+	// decision 53 (R-736): the app's image repositories, read BEFORE the remove (its compose and records go).
+	removedRepos := appImageRepos(stackDir, LoadAppConfig(stackDir))
+
 	// Step 2: Run docker compose down --rmi local --volumes
 	// H14: Return error if docker compose down fails — continuing would leave orphaned containers.
 	env := m.stackEnv(stackDir)
@@ -364,6 +367,7 @@ func (m *Manager) DeleteStack(name string, removeHDDData bool) (*DeleteResponse,
 	if err := m.ScanStacks(); err != nil {
 		m.logger.Printf("[WARN] Rescan after delete failed: %v", err)
 	}
+	go m.RetainImagesAfterRemove(name, removedRepos) // decision 53 (R-736): the removed app's images, if nothing keeps them
 
 	return resp, nil
 }