Add prune-registry.sh: keeps the moving tag and newest versioned tag per distro plus their cosign signature tags, deletes the rest via the Gitea packages API. Wire it into the prune job (uses REGISTRY_TOKEN).
