gitea-image-prune.sh: keep the newest 20 and every version in use; refuse when the in-use list is unreadable (Felhom 09 decision 62, R-750)

Protected whatever --keep says: the controller floor, the vouched golden, the vouched agent and min_agent (the hub's
Configuration page), every image of ours the vouched golden baked (its bake.log), the hub manifest's image. The dry-run
prints each kept version and why. tests/test-prune-plan.sh pins it without network (red-proofed). No --apply was run.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to the operator helper scripts. Newest on top.
 
+## 2026-10-01
+
+### Changed — `gitea-image-prune.sh`: the retention rule (Felhom `09` §3 decision 62, R-750)
+- A prune keeps the newest **20** versions (`--keep` defaults to 20) **plus every version in use**: the controller
+  floor, the vouched golden, the vouched agent and its `min_agent` (the hub's operator Configuration page, `HUB_PW`),
+  every image of ours the vouched golden baked (its `bake.log` in `felhom.eu`), and the hub image `manifests/hub.yaml`
+  runs. The dry-run prints each kept version and why. **An unreadable in-use list refuses the prune (exit 3).**
+- `tests/test-prune-plan.sh` (no network: test seams `PRUNE_TEST_VERSIONS`, `PRUNE_TEST_PROTECT`): an in-use version
+  older than the newest 20 stays; red-proof: without the in-use list it is deleted, and with the check removed from
+  `is_protected` the test fails.
+- The "cron-friendly" and "set-and-forget Gitea rule" advice removed: nothing schedules a prune; `--apply` is a person's act.
+- Recorded: the 2026-08-22 16:02 UTC run (`--all --keep 7 --apply`, HM-024) predates this rule — it is why the oldest
+  `felhom-controller` left is 0.213.0.
+
 ## 2026-06-17 (later)
 
 ### Changed — `gitea-image-prune.sh`