feat(2pc): PC1 conservative prune — drop autoPrune --all, add gated surgical docker-prune

Removes virtualisation.docker.autoPrune (daily `docker system prune --all` evicted in-use base
images → cold re-pull → Hub rate-limit churn, JOURNAL-2). Adds modules/docker-prune.nix: daily
timer + oneshot that prunes only dangling+until=24h, gated on disk pressure (>=80%) AND no run-app
live AND no swarm service converging; never --all, never --volumes. Teardown unchanged (never
removes images). Registry pull-through cache dropped per operator scope correction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nix/modules/swarm.nix

@@ -5,18 +5,14 @@
 {
   virtualisation.docker = {
     enable = true;
-    # Reclaim disk from churning per-run images (cc-ci root is ~28 GiB). Prune images/containers/
-    # networks/build-cache older than 24h — but NEVER volumes:
-    #  (1) `--volumes` is incompatible with `--filter until=` (docker errors → the unit failed daily,
-    #      degrading the system and never actually pruning — that's why disk crept to 96%); and
-    #  (2) Phase 2w keeps DATA-WARM canonical volumes that are UNDEPLOYED (no container), so
-    #      `prune --volumes` would DELETE the warm known-good data. Warm volumes are pruned
-    #      deliberately by the warm reconcilers (WC8), never by this blanket sweep.
-    autoPrune = {
-      enable = true;
-      dates = "daily";
-      flags = [ "--all" "--filter" "until=24h" ];
-    };
+    # Image pruning is handled by modules/docker-prune.nix (Phase 2pc / PC1), NOT by
+    # `virtualisation.docker.autoPrune`. The old autoPrune ran `docker system prune --all` daily;
+    # `--all` evicts every image not used by a *running* container — between runs that wiped the
+    # cached recipe base images and forced a cold re-pull → the Docker-Hub-rate-limit churn in
+    # JOURNAL-2. The replacement keeps Docker's local store warm (it IS our cache on this single
+    # host) and prunes only dangling+old layers, gated on genuine disk pressure and nothing in
+    # flight. NEVER --volumes either: Phase-2w keeps DATA-WARM undeployed canonical volumes, reaped
+    # only by the warm reconcilers. autoPrune left OFF (the default) on purpose.
   };
 
   environment.systemPackages = [ pkgs.docker ];