Add explicit CAOS image cache cleanup - #120

What this adds

A manual, dry-run-first reset for CAOS's rebuildable image caches.

caosd image-cleanup
caosd down
caosd image-cleanup --execute
caosd up

The dry run reports the registry's disk usage and the local Docker images belonging to the CAOS registry repository.

With --execute, the command:

• refuses to run while the host stack, a runner-owned worker, or a shared test stack is active;
• removes $CAOS_DATA/stack/registry, which contains OCI manifests, configs, and layers;
• removes $CAOS_DATA/stack/redis, because cached results can refer to registry digests that were just removed;
• asks Docker to remove local images from the exact CAOS repository; and
• preserves the server and publisher Git repositories.

The next caosd up recreates the caches and republishes std. Other images are rebuilt on demand.

The PR also retires superseded caos-stack-src tags inside load_once, where those tags are created, and defines the local registry endpoint once for publishing, checks, port exposure, server pulls, and cleanup.

Scope

This is an explicit full cache reset. It does not implement last-used tracking, age-based retention, a size ceiling, or automatic cleanup. It does not change the default location of CAOS_DATA.

Validation

• nix build
• bash -n result/bin/caosd
• live non-destructive caosd image-cleanup
• live caosd std-check