feat(forgejo): add package prune script with retention depth 3

List and optionally delete package versions beyond the newest three,
protecting production Helm image tags. Adds Make targets and unit tests
for ACTIVITY-WP-0020.

docs/forgejo-package-prune.md

@@ -0,0 +1,46 @@
+# Forgejo package prune (retention)
+
+Workplan: `ACTIVITY-WP-0020` · complements `docs/forgejo-backup.md`
+
+## Policy
+
+| Rule | Value |
+| --- | --- |
+| Versions kept per package | **3** (newest by `created_at`) |
+| Package types (phase 1) | `container`, `pypi`, `npm`, `generic` |
+| Org scope | `coulomb` |
+| Protected versions | Image tags referenced in `railiance-apps` production Helm values / chart defaults |
+| Default mode | dry-run (no deletes) |
+| Schedule | Weekly Sunday 03:30 UTC via `activity-core` (`weekly-forgejo-package-prune`) |
+
+OCI container layers dominate `forgejo dump` size (~80% of blob zip). Pruning old
+tags slows backup growth and shortens chunked-copy duration.
+
+## Operator commands
+
+```bash
+cd ~/railiance-platform
+export FORGEJO_TOKEN=...   # or FORGEJO_TOKEN_FILE=/path/to/token
+
+make forgejo-package-prune-dry-run   # list would-delete candidates
+make forgejo-package-prune           # delete beyond retention depth
+```
+
+Requires a Forgejo PAT with `read:package` and `write:package`. Resolve custody via
+`warden route find "forgejo package token"` — do not store tokens in Git.
+
+## Rollback
+
+If a needed tag was removed, restore from the latest Nextcloud `forgejo-dump-*.zip.age`
+(`make forgejo-backup` evidence) using `railiance-infra/tools/forgejo-restore-drill.sh`,
+or re-push the image from CI.
+
+## Evidence
+
+activity-core posts `forgejo_package_prune` progress to State Hub with non-secret
+counts (`deleted_count`, `candidate_count`, `skipped_protected_count`, `errors`).
+
+## Related
+
+- `railiance-apps/docs/forgejo-package-registry.md`
+- `docs/forgejo-backup.md`