ci: bound CI storage; don't bridge image-build jobs

- deploy/runner/prune.sh + windygit-ci-prune.timer (6h): age-based prune
  of the CI-only dind (containers, finished-job volumes, images/builder
  cache >7d) plus a hard 60 GB cap. Only that daemon, over its own TCP
  socket; never the host's Docker. It was 38 GB and unbounded — the same
  class of growth that filled Kit 0 on 09-01.
- pr_status_bridge: jobs named *docker* are not posted. Job containers
  have no daemon by design (I-5), so they are red on every commit; a
  permanent red X teaches everyone to ignore red.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/CUTOVER.md

@@ -107,6 +107,10 @@ their CI permanently, not a stopgap:
 - Covered repos: `BRIDGE_REPOS` in the script. Public repos are left out on
   purpose; they run real GitHub Actions and two verdicts per commit is noise.
 - `skipped` jobs post nothing — no green for a job nobody ran.
+- **Image-build jobs** (name matches `docker`) post nothing: job containers
+  have no Docker daemon by design (I-5), so they are red on every commit. A
+  rootless builder (BuildKit rootless / buildx in the capped dind) is the open
+  decision that would bring them back.
 
 **Onboarding another private repo** — the promotion steps below, then: