Keep Forgejo prune inventory outside replaceable checkouts

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

k8s/railiance/20-runtime.yaml

@@ -48,6 +48,46 @@ metadata:
     app.kubernetes.io/name: activity-core
     app.kubernetes.io/part-of: activity-core
 data:
+  weekly-forgejo-package-prune.md: |
+    ---
+    id: weekly-forgejo-package-prune
+    name: Weekly Forgejo Package Prune
+    enabled: true
+    owner: custodian-agent
+    governance: custodian
+    status: active
+    trigger:
+      type: cron
+      cron_expression: "30 3 * * 0"
+      timezone: UTC
+      misfire_policy: skip
+    context_sources:
+      - type: shell
+        query: forgejo_package_prune
+        operation: forgejo_package_prune
+        required: true
+        params:
+          prune_script: /opt/railiance-platform/tools/cmd/forgejo-package-prune
+          live_images_file: /var/lib/railiance-platform/live-images/all.txt
+          apply: true
+          max_versions: 3
+          evidence_sinks:
+            - type: state-hub-progress
+              event_type: forgejo_package_prune
+              author: activity-core
+        bind_to: context.prune
+    ---
+
+    # Weekly Forgejo Package Prune
+
+    Runs every Sunday at 03:30 UTC (after the 02:15 `forgejo-backup` cron). Invokes
+    `railiance-platform/tools/cmd/forgejo-package-prune` to retain the newest **3**
+    versions per `coulomb` package (OCI, PyPI, npm, generic). Production image tags
+    (live cluster + Helm values) are protected.
+
+    **Enabled 2026-07-21** (`ACTIVITY-WP-0020` T05/T06): first apply deleted 38
+    stale package versions; worker has `FORGEJO_TOKEN` + host-mounted
+    `/opt/railiance-platform` prune tools.
   glas-profile-pilot.md: |
     ---
     id: glas-profile-pilot
@@ -1361,6 +1401,9 @@ spec:
             - name: railiance-platform
               mountPath: /opt/railiance-platform
               readOnly: true
+            - name: live-image-inventory
+              mountPath: /var/lib/railiance-platform/live-images
+              readOnly: true
             - name: kubeconfigs
               mountPath: /kube
               readOnly: true
@@ -1385,6 +1428,10 @@ spec:
           hostPath:
             path: /home/tegwick/railiance-platform
             type: Directory
+        - name: live-image-inventory
+          hostPath:
+            path: /home/tegwick/.local/state/railiance-platform/live-images
+            type: Directory
         - name: kubeconfigs
           hostPath:
             path: /home/tegwick/.kube