feat(ci): prune release assets outside the newest two tags (#52) (#70)

Closes #52.

Adds `scripts/prune-release-assets.sh` and a best-effort step at the end of `build-binaries.yml`.

- Lists every release page, sorts by creation date, skips the newest two published releases, deletes the rest's attachments via `DELETE /releases/{id}/assets/{asset_id}`.
- Drafts never consume a keep slot, so a draft cannot strip the newest real release.
- Releases, tags, source archives and release notes are never touched.
- Nothing is excluded: SHA256SUMS and the wrappers go with the binaries. Checksums are only meaningful next to the files they cover, and the consumer drift-check reads the wrappers from the latest release, which stays complete.
- Failures warn and the step has `continue-on-error: true` — a stale asset is cheaper than a blocked publish.

`tests/prune-release-assets.sh` drives the script with a stub `curl`: keep window, out-of-order responses, drafts, no non-asset DELETE, short-page pagination stop, and both failure paths. Wired into `make check`.

v0.2.0 still needs its 9 assets cleared by hand in the web UI, as the issue notes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #70

Co-authored-by: vickydotbat <vickydotbat@tutamail.com>

tests/workflow-contract.sh

@@ -46,6 +46,8 @@ grep -Fqx '  releases: write' "$release"
 grep -Fqx '    timeout-minutes: 30' "$release"
 [[ "$(grep -Fc "$checkout" "$release")" -eq 1 ]]
 grep -Fq 'secrets.GITEA_TOKEN' "$release"
+grep -Fq 'scripts/prune-release-assets.sh' "$release"
+grep -Fq 'continue-on-error: true' "$release"
 if grep -Fq 'secrets.GITHUB_TOKEN' "$release"; then
   echo "workflow-contract: release uses the GitHub token alias" >&2
   exit 1