Automate Artifact Registry image cleanup + purge dead image repos

[anth-volk]

Fixes #3743

What & why

policyengine-api Artifact Registry is ~$45/mo, 100% storage — ~628 GiB of Docker images that nothing prunes. Two repos grow on every deploy; three are frozen dead weight.

This PR adds the ongoing automated pruning. (The one-time backlog purge — deleting the ~552 GiB of dead legacy repos + gae-flexible orphans — is a manual operation run out-of-band, not shipped here.)

Ongoing cleanup (in the deploy pipeline)

• Cloud Run images — keep 15. New cleanup_cloud_run_images.sh + a cleanup-cloud-run-images job (after deploy-cloud-run-candidate): keeps the 15 most recent images in the policyengine-api repo, deletes older. Sorts in-script by createTime — gcloud's Artifact Registry --sort-by proved unreliable.
• App Engine Flex images — version-aware. Extended cleanup_app_engine_versions.sh: when it deletes a version, it also deletes that version's gae-flexible/default.<id> image, keeping the repo in lockstep with the retained versions. This is not a blind keep-15: staging/prod images interleave, so keeping "15 most recent" would delete a kept older stopped-prod version's image and break its rollback.

Verification

• Dry-run against live: Cloud Run cleanup keeps 15 / deletes 3 (in-script sort works); the extended App Engine cleanup runs clean.
• Tests extended (test_app_engine_cleanup_scripts.py, stubbed gcloud artifacts): keep-15, version-aware gae-flexible deletion, and the disable toggle — 15 passing, ruff clean.

Safety notes

• Confirmed gae-flexible is the live App Engine image store (staging-2411 → …/gae-flexible/default.staging-2411-…), so it is pruned version-aware, never wholesale.
• Deleting an image an old Cloud Run revision still references stops that revision from restarting — acceptable; Cloud Run is the non-primary migration candidate and 15 is a generous window.

Expected impact

Ongoing: both live repos stay bounded to 15 images. Combined with the one-time backlog purge, AR storage **$45/mo → ~$3–5/mo**.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.89%. Comparing base (4407075) to head (08176b4).
⚠️ Report is 26 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3742      +/-   ##
==========================================
+ Coverage   79.82%   79.89%   +0.07%     
==========================================
  Files          70       70              
  Lines        4336     4332       -4     
  Branches      808      807       -1     
==========================================
  Hits         3461     3461              
+ Misses        655      652       -3     
+ Partials      220      219       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.