Retain verified wiki releases and expire unused CI images

scripts/deploy.sh

@@ -17,7 +17,7 @@ test "$(git -c safe.directory="$PWD" rev-parse HEAD)" = "$RELEASE_SHA"
 LATEST_MAIN=$(git -c safe.directory="$PWD" ls-remote origin refs/heads/main | cut -f1)
 if [ "$LATEST_MAIN" != "$RELEASE_SHA" ]; then
   git -c safe.directory="$PWD" fetch origin main
-  if ! git -c safe.directory="$PWD" diff --quiet "$RELEASE_SHA" origin/main -- apps/waterfall-wiki Dockerfile compose.yml scripts/deploy.sh scripts/infra.sh scripts/integration.sh scripts/auth-admin.sh .gitea/workflows/waterfall-wiki.yml pnpm-workspace.yaml; then
+  if ! git -c safe.directory="$PWD" diff --quiet "$RELEASE_SHA" origin/main -- apps/waterfall-wiki Dockerfile compose.yml scripts/deploy.sh scripts/wiki-image-lifecycle.py scripts/infra.sh scripts/integration.sh scripts/auth-admin.sh .gitea/workflows/waterfall-wiki.yml pnpm-workspace.yaml; then
     echo 'Skipping deployment: Wiki has a newer commit'; exit 0
   fi
 fi
@@ -135,6 +135,10 @@ if command -v systemctl >/dev/null; then
   if systemctl is-active --quiet prompt.service || systemctl is-active --quiet prompt-worker.service; then echo 'Legacy host service is unexpectedly running'; false; fi
 fi
 echo "Full Docker deployment verified: web+worker+postgres+objects port=$PORT release=$RELEASE_SHA"
+# Register only after every deployment check succeeded; ledger failure retains old images.
+if ! python3 scripts/wiki-image-lifecycle.py record-success --sha "$RELEASE_SHA"; then
+  echo "Warning: successful-release ledger update failed; runtime cleanup stays conservative" >&2
+fi
 # Read-only network diagnostics: a private address alone is not a public entrypoint.
 echo "Host: $(hostname)"
 hostname -I || true