ci: free the runner's disk after every build

The images go to the registry with --push, but each build also left its
tagged images in the runner's local store and an unbounded build cache:
after a day of builds the runner's 10Gi Docker volume filled up and run 21
died mid-build (no space left on device). A final step, run even when the
build fails, removes our pushed tags and caps the build cache at 4GB
(recent layers stay, so builds stay cached).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ

.gitea/workflows/images.yml

@@ -54,3 +54,14 @@ jobs:
               .
             echo "pushed $image"
           done
+
+      # The images live in the registry now; the runner keeps only a bounded build cache. Without this the
+      # runner's 10Gi Docker volume fills up after a handful of builds (no space left on device mid-build).
+      - name: Free the runner's disk
+        if: always()
+        run: |
+          set -u
+          docker image ls --format '{{.Repository}}:{{.Tag}}' | grep "^$IMAGE_PREFIX/" | xargs -r docker image rm -f
+          docker image prune -f
+          docker builder prune -f --keep-storage 4GB
+          docker system df