v0.284.2 — the image clean-up sees digest-pulled (untagged) images (decision 53, R-736)

Found live on 9202: the product pins tag@digest, and such images are stored untagged (repo:<none>);
`docker image ls` without -a did not list them, so the retention saw almost no app image. Now `image ls -a`;
an anonymous <none>:<none> entry is never a candidate; the one-time marker is v2 so the corrected sweep runs
once everywhere. Test TestImageRetention_SeesUntaggedDigestPulledImages, red-proofed. 0.284.0/0.284.1 were
never floored.

MinAgent: 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,17 @@
+## v0.284.2 — the image clean-up sees digest-pulled (untagged) images (2026-09-30)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings. v0.284.0 and v0.284.1 were never
+floored (scratch 9202 only); the fleet goes from 0.283.1 to 0.284.2.
+
+- **Found live on 9202:** the product pins `tag@digest` (v0.269), and an image pulled that way is stored UNTAGGED
+  (`repo:<none>`). `docker image ls` without `-a` did not list any of them, so the retention could not see most app
+  images: the one-time sweep deleted 3 images while dozens of old untagged app images stayed. Now `image ls -a`; an
+  untagged image keeps its repository name, so it is attributed like any other; a fully anonymous `<none>:<none>`
+  entry is never a candidate. The one-time marker is `image-retention-v2.done`, so the corrected sweep runs once on
+  every box (9202 ran the blind v1).
+- Test `TestImageRetention_SeesUntaggedDigestPulledImages` (the fake Docker hides untagged images without `-a`, as
+  measured); red-proof: drop `-a` → it fails.
+
 ## v0.284.1 — the image clean-up also runs on the household's Remove button; one summary line per pass (2026-09-30)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings. **v0.284.0 was never floored** — it