v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

Image retention: after a done/undone guarded Update and at remove, an app's images older than its running
and previous one are deleted — never an image any container, installed compose or installed/previous record
names (box-wide keep set read at delete time); exact id, never forced or pruned; paused while any update runs;
a one-time sweep of catalog app images at the first start. Install hold: an after_install app is installed
behind the setup gate's door and opens when after_install succeeds or the household says it changed the login.
Tests TestImageRetention_* and TestInstallHold_* with red-proofs; parity fixture for the held card.

MinAgent: 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/i18n_parity_test.go

@@ -329,6 +329,17 @@ func i18nCases() []i18nCase {
 		}}
 	}
 	base = append(base, gateCase("app_info_setup_gate_button", false), gateCase("app_info_setup_gate_probe", true))
+	// R-741: the install hold's card, while an after_install app waits for its first-login change.
+	base = append(base, i18nCase{"app_info_install_hold", "app_info", func() map[string]interface{} {
+		d := i18nLayoutData("stacks", "Calibre")
+		st := stacks.Stack{Name: "calibre-web", Deployed: true, State: stacks.StateRunning}
+		st.Meta = stacks.Metadata{DisplayName: "Calibre", Slug: "calibre-web"}
+		d["Stack"] = st
+		d["Meta"] = st.Meta
+		d["AppInfo"] = st.Meta.AppInfo
+		d["InstallHoldClosed"] = true
+		return d
+	}})
 	// v0.281.0 (decision 47): the sign-up card, closed (with the app's how-to) and open for the household's window.
 	signupCase := func(name string, closed bool, until string) i18nCase {
 		return i18nCase{name, "app_info", func() map[string]interface{} {