fix: reclaim unused images during critical disk pressure

docs/warm.md

@@ -86,9 +86,10 @@ back cleanly to a full cold run (the PR is still tested).
   skips if a `run_recipe_ci.py` is active. At most MAX_TESTS apps are ever live at once.
 - **Warm keycloak shared safely** via per-run namespaced realms (above); orphan realms reaped.
 - **Disk** (warm is the budget, not RAM): the `ci-docker-prune` unit (`nix/modules/docker-prune.nix`,
-  Phase-2pc) prunes only **dangling** images/containers/build-cache (`until=24h`), and only under
-  genuine disk pressure (`/` ≥ 80%) with nothing in flight — **never `--all`** (keeps cached base/
-  in-use images warm; the local store IS the cache on this single host) and **never `--volumes`** (so
+  Phase-2pc) prunes dangling images/containers/build-cache (`until=24h`) under
+  disk pressure (`/` ≥ 80%) when no service is converging. At `/` ≥ 90%, it also removes unused
+  images older than seven days, even if a warm service is crash-looping. It skips while a run-app
+  stack is live and never uses `--volumes` (so
   data-warm canonical volumes survive). Each canonical = one data volume + one snapshot (small; the
   keycloak DB snapshot ~300M dominates). `canonical.prune_stale()` (run nightly) drops warm data for
   **de-enrolled** canonicals. Monitor with `df -h /` (the nightly logs it).