Finish ACTIVITY-WP-0020: enable weekly Forgejo package prune

First apply deleted 38 stale versions; enable schedule with live-images
protection file for worker pods without kubectl; restore path for live
state-hub tags after an unprotected worker apply.

src/activity_core/context_resolvers/forgejo_prune.py

@@ -29,6 +29,18 @@ def forgejo_package_prune(params: dict[str, Any]) -> dict[str, Any]:
     if apply:
         cmd.append("--apply")
 
+    # ACTIVITY-WP-0020: worker pods often lack kubectl, so live-tag protection
+    # must come from an explicit multi-cluster image list file (hostPath).
+    live_images = params.get("live_images_file") or os.environ.get(
+        "FORGEJO_LIVE_IMAGES_FILE", ""
+    )
+    if live_images:
+        live_path = Path(str(live_images)).expanduser()
+        if live_path.is_file():
+            cmd.append(f"--live-images-file={live_path}")
+        else:
+            logger.warning("live_images_file not found: %s", live_path)
+
     env = os.environ.copy()
     completed = subprocess.run(
         cmd,