feat(builds): clean up the build machine's registry #409

Problem

Every remote build (#405) pushes an image to the build machine's registry, and nothing removes it. Image cleanup only covers the host's Docker Engine. Layers are shared between images, so the registry grows slowly, but without bound.

Proposed solution

• piqueld's image cleanup also deletes, from the registry, the images it pushed that no retained deployment refers to. The registry has to allow deletes.
• The registry's own garbage collection, run on the build machine (feat(nix): a build machine module #408), then reclaims their layers.
• A setting for how many deployments' images the registry keeps, which can be more than images.keep_deployments, since the build machine has the larger disk.

Cleanup skips the registry while the build machine is unreachable.

Depends on #405. Part of #403.

Written with Claude Fable 5.2 in Claude Code (via T3 Code).