miren-oci registry has no retention — 236GB, dominated by 2360 miren image versions

While root-causing MIR-1280 we inventoried the miren-oci Artifact Registry (us-central1, project miren-cloud). It's 236GB with no retention policy — every version ever pushed is still resident.

Breakdown (sum of manifest sizes, ~293GB before dedup):

• miren: ~190GB across 2360 versions — the runtime image, one per CI build since July 2025, never pruned. This is ~80% of the registry.
• Base language images (golang 268, python 351, ruby 270, node 137, rust 93, bun 35, alpine 119 versions): ~55GB, accumulated by the old periodic mirror sync.
• DB/infra images (postgres 416, mysql, redis, clickhouse, …): ~20GB.
• The new pull-through caches (dockerhub-remote, ghcr-remote, …) are negligible: <700MB total.

This did not cause the MIR-1279 outage — Artifact Registry is GCS-backed, not on garden's disk — but it's the same disease as MIR-1280 (no retention anywhere) and a real storage cost.

Suggested work

• Retention for the miren runtime image: keep released + recent-N, prune the CI churn. Likely its own story, distinct from app-artifact retention in MIR-329 but related.
• Base-image history (~55GB) is largely prunable now that the pull-through cache re-fetches on demand.
• Decide on an Artifact Registry cleanup policy (age/count) so this doesn't silently climb again.