ci: bound CI storage; don't bridge image-build jobs

- deploy/runner/prune.sh + windygit-ci-prune.timer (6h): age-based prune
  of the CI-only dind (containers, finished-job volumes, images/builder
  cache >7d) plus a hard 60 GB cap. Only that daemon, over its own TCP
  socket; never the host's Docker. It was 38 GB and unbounded — the same
  class of growth that filled Kit 0 on 09-01.
- pr_status_bridge: jobs named *docker* are not posted. Job containers
  have no daemon by design (I-5), so they are red on every commit; a
  permanent red X teaches everyone to ignore red.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/tests/test_pr_status_bridge.py

@@ -138,3 +138,12 @@ def test_pr_mirror_opened_once_and_closed_when_github_closes(fake, monkeypatch):
     f2 = fake(gh_prs=[_gh_pr(7)], wg_prs=[{"number": 4, "title": "[GH#7] t"}])
     bridge.sync_prs("r")
     assert f2.opened == [] and f2.closed == []
+
+
+def test_image_build_jobs_are_not_posted(fake):
+    """No Docker daemon in job containers (I-5): a build job's red is structural."""
+    f = fake(
+        runs=[_run(1, "ci.yml", "Docker Build", "failure"), _run(2, "ci.yml", "docker", "failure")]
+    )
+    bridge.post_statuses("r", SHA)
+    assert f.posted == []