ci: build weekly and prune old releases

Schedule moves to Mondays 04:00 UTC. release.sh now deletes older releases
for the same image/distro (and their assets and tags) after publishing, so
only the newest is kept. Add prune-releases.sh for a one-off cleanup.

release.sh

@@ -156,3 +156,29 @@ curl -fsSL -X POST \
   "${API}/releases/${release_id}/assets?name=${ASSET_NAME}"
 
 echo "Published release ${RELEASE_TAG}."
+
+# --- prune older releases (and their assets/tags) for this image/distro -----
+echo "Pruning older ${IMAGE} ${DISTRO} releases ..."
+old_releases=""
+page=1
+while :; do
+  page_json="$(curl -fsSL -H "Authorization: token ${TOKEN}" \
+    "${API}/releases?limit=50&page=${page}")"
+  [[ "$(jq 'length' <<< "${page_json}")" -eq 0 ]] && break
+  old_releases+="$(jq -r --arg prefix "${IMAGE}-${DISTRO}." --arg keep "${release_id}" \
+    '.[] | select(.tag_name | startswith($prefix)) | select((.id | tostring) != $keep) | "\(.id)\t\(.tag_name)"' \
+    <<< "${page_json}")"$'\n'
+  page=$((page + 1))
+  [[ "${page}" -gt 20 ]] && break
+done
+
+while IFS=$'\t' read -r old_id old_tag; do
+  [[ -z "${old_id}" ]] && continue
+  echo "  removing release ${old_tag}"
+  curl -fsSL -X DELETE -H "Authorization: token ${TOKEN}" \
+    "${API}/releases/${old_id}" >/dev/null || true
+  curl -fsSL -X DELETE -H "Authorization: token ${TOKEN}" \
+    "${API}/tags/${old_tag}" >/dev/null || true
+done <<< "${old_releases}"
+
+echo "Done."