App version retention: prune old versions beyond a configurable limit

AppVersions accumulate indefinitely. Every deploy creates a new version entity that lives forever in the entity store. With the ephemeral deployment GC controller (PR #745) scanning all AppVersions every 5 minutes, this becomes a concrete performance concern: that scan grows linearly with total deploys across the cluster's lifetime.

We should automatically hard-delete old non-active, non-ephemeral AppVersions once they're no longer needed. Ephemeral versions already have their own GC via TTL expiry, so this is about the normal version lifecycle.

Open questions: count-based retention (keep most recent N per app), time-based retention (delete versions older than X days), some combination of both, and whether we should also clean up associated artifacts and config versions.