Finish ACTIVITY-WP-0020: enable weekly Forgejo package prune

First apply deleted 38 stale versions; enable schedule with live-images
protection file for worker pods without kubectl; restore path for live
state-hub tags after an unprotected worker apply.

activity-definitions/weekly-forgejo-package-prune.md

@@ -1,10 +1,10 @@
 ---
 id: weekly-forgejo-package-prune
 name: Weekly Forgejo Package Prune
-enabled: false
+enabled: true
 owner: custodian-agent
 governance: custodian
-status: proposed
+status: active
 trigger:
   type: cron
   cron_expression: "30 3 * * 0"
@@ -15,7 +15,9 @@ context_sources:
     query: forgejo_package_prune
     required: true
     params:
-      apply: false
+      prune_script: /opt/railiance-platform/tools/cmd/forgejo-package-prune
+      live_images_file: /opt/railiance-platform/docs/evidence/live-images-all.txt
+      apply: true
       max_versions: 3
       evidence_sinks:
         - type: state-hub-progress
@@ -29,7 +31,8 @@ context_sources:
 Runs every Sunday at 03:30 UTC (after the 02:15 `forgejo-backup` cron). Invokes
 `railiance-platform/tools/cmd/forgejo-package-prune` to retain the newest **3**
 versions per `coulomb` package (OCI, PyPI, npm, generic). Production image tags
-pinned in `railiance-apps` Helm values are protected.
+(live cluster + Helm values) are protected.
 
-Ships disabled until dry-run evidence is reviewed. Set `params.apply: true` and
-`enabled: true` after operator approval (`ACTIVITY-WP-0020` T05).
+**Enabled 2026-07-21** (`ACTIVITY-WP-0020` T05/T06): first apply deleted 38
+stale package versions; worker has `FORGEJO_TOKEN` + host-mounted
+`/opt/railiance-platform` prune tools.