ci(gate): keep BuildKit cache unless the runner is actually short on disk

deploy/reclaim-runner-disk.sh ran `docker builder prune --force --all` at the
start of every gate job, so each publish rebuilt the Dockerfile `npm ci` layer
from scratch behind the registry mirror (7-minute image builds became 47).
Reclaim build cache in tiers instead: prune entries unused for 72h, re-measure
free space, and escalate to `--all` only while still below MINIMUM_FREE_GIB.
The final threshold check and the "only unheld resources" rules are unchanged.

Contract test asserts the aged prune runs first and that `--all` is only
reachable inside the re-measured conditional.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VawU7Xfd5jS9wUEXz1XYmS

deploy/reclaim-runner-disk.sh

@@ -66,7 +66,21 @@ if [ -n "$STALE_IMAGES" ]; then
   printf '%s\n' "$STALE_IMAGES" | xargs -r docker image rm || true
 fi
 
-docker builder prune --force --all
+# BuildKit layer cache is what lets the publish job reuse the Dockerfile
+# `npm ci` layer instead of rebuilding it from scratch behind the mirror (a
+# 7-minute image build versus 47). `docker image prune --force` above removes
+# only dangling images; BuildKit cache records live in the builder store, not
+# in dangling images, so nothing before this point touches them. Reclaim them
+# in tiers: drop entries nobody has used for 72 hours, re-measure, and escalate
+# to `--all` only when the runner is still below the threshold.
+docker builder prune --force --filter until=72h
+
+TIERED_GIB="$(free_gib)"
+echo "docker root $DOCKER_ROOT has ${TIERED_GIB} GiB free after aged build-cache reclaim"
+if [ "$TIERED_GIB" -lt "$MINIMUM_FREE_GIB" ]; then
+  echo "still below ${MINIMUM_FREE_GIB} GiB; escalating to a full BuildKit cache prune"
+  docker builder prune --force --all
+fi
 
 AFTER_GIB="$(free_gib)"
 echo "docker root $DOCKER_ROOT has ${AFTER_GIB} GiB free after reclaim"