feat(ci): prune release assets outside the newest two tags (#52)

Gitea has no release-asset retention, so every v* tag kept its full
cross-platform binary set forever — 31 tags had accumulated 1.8 GB on the
production host disk. Nothing consumes an old asset: CI takes the Crucible
binary from the Nix flake, and every deleted file is reproducible from its tag.

scripts/prune-release-assets.sh lists every release page, sorts by creation
date, skips the newest two published releases, and deletes the remaining
releases' attachments. Two rather than one so a release in flight never leaves
the previous download broken. Drafts never consume a keep slot. Releases, tags,
source archives and release notes are untouched.

Nothing is excluded — SHA256SUMS and the wrappers go with the binaries: the
checksums are only meaningful next to the files they cover, and the consumer
drift-check reads the wrappers from the latest release, which stays complete.

The step is best-effort: a stale asset is cheaper than a blocked publish, so
API failures warn and the step carries continue-on-error.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -85,7 +85,9 @@ https://git.westgate.pw/ShadowsOverWestgate/sow-docs).
 - `ci.yml` — vet, test, shellcheck, yamllint, binary smoke, and cross-build all
   targets once per pull request.
 - `build-binaries.yml` — on a `v*` tag, cross-build and upload the binaries,
-  `SHA256SUMS`, and the wrappers to the Gitea release.
+  `SHA256SUMS`, and the wrappers to the Gitea release, then delete the assets
+  of every release except the newest two — Gitea keeps them forever otherwise,
+  and every binary is reproducible from its tag.
 - `sync-wrappers.yml` — on a `main` push that touches `wrappers/`, auto-PR the
   canonical wrappers to the consumer repos in `wrappers/consumers.txt`.
   Consumer drift checks run after those PRs merge to `main`, not on the PRs