Add GHCR package retention workflow

[atulmgupta]

Replace ad hoc image cleanup with a tested retention policy that inventories all published GHCR packages, generates dry-run reports, and supports manual deletion with protected version pins. Document the retention rules and link them from release verification.

Description

Closes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would break existing functionality)
• Documentation update
• Infrastructure / CI change

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have added tests that prove my fix is effective or my feature works
• New and existing tests pass locally
• I have updated the documentation accordingly
• My changes generate no new warnings

Screenshots (if applicable)

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical workflow and test defects, plus validation and reporting gaps, remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• Pin setup-node to an immutable commit SHA · New
• Use oldest fixture rows to test rollback floor · New

What changed in this PR

Adds a GHCR package-retention workflow with policy-driven inventory, dry-run reporting, protected versions, controlled deletion, tests, and documentation.

Changes:

• Implements retention planning, preflight validation, and deletion reporting.
• Adds package policies and retention tests.
• Documents retention rules and links them from release verification.

File	Description
scripts/​package-retention.test.mjs	Tests retention and deletion safety behavior.
scripts/​package-retention.mjs	Implements inventory, retention, preflight, and deletion logic.
ops/​release/​package-retention.json	Defines packages, retention thresholds, and protected pins.
docs/​operations/​release-verification.md	Links release verification to retention documentation.
docs/​operations/​package-retention.md	Documents retention policies and safety boundaries.
.github/​workflows/​cleanup.yml	Runs scheduled and manual retention operations.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Verify TypeScript build

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.