feat(ci): prune release assets outside the newest two tags (#52)

Gitea has no release-asset retention, so every v* tag kept its full
cross-platform binary set forever — 31 tags had accumulated 1.8 GB on the
production host disk. Nothing consumes an old asset: CI takes the Crucible
binary from the Nix flake, and every deleted file is reproducible from its tag.

scripts/prune-release-assets.sh lists every release page, sorts by creation
date, skips the newest two published releases, and deletes the remaining
releases' attachments. Two rather than one so a release in flight never leaves
the previous download broken. Drafts never consume a keep slot. Releases, tags,
source archives and release notes are untouched.

Nothing is excluded — SHA256SUMS and the wrappers go with the binaries: the
checksums are only meaningful next to the files they cover, and the consumer
drift-check reads the wrappers from the latest release, which stays complete.

The step is best-effort: a stale asset is cheaper than a blocked publish, so
API failures warn and the step carries continue-on-error.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-binaries.yml

@@ -65,3 +65,17 @@ jobs:
                 "${api}/releases/${id}/assets?name=$(basename "$f")"
             done
           '
+
+      # Gitea has no asset retention (#52): without this every tag keeps its
+      # ~57 MB binary set forever. Best-effort — a stale asset is cheaper than
+      # a blocked publish, so a failure here never fails the release.
+      - name: Prune assets of older releases
+        continue-on-error: true
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          REPO: ${{ github.repository }}
+          SERVER: ${{ github.server_url }}
+        run: |
+          nix develop --command bash -c '
+            API="${SERVER}/api/v1/repos/${REPO}" scripts/prune-release-assets.sh
+          '