[abn]

Adds aetherpak deltas prune, a serialized maintenance command for the delta tag set. Stacked on #174.

What changed

• Removes _delta-* tags whose target image returns a definitive 404, confirmed with two probes.
• Removes _deltasrc-* tags that no surviving delta or application tag references, plus dangling source tags.
• Rebuilds _deltaindex strictly from the surviving tags and refreshes every descriptor.
• --dry-run reports candidates without deleting. --output-file emits delta-tags, source-tags, and index-rebuilt.
• Per-tag delete failures are collected and the index rebuild still runs. Auth, network, and other transient probe errors leave tags untouched.
• A source tag must resolve to the digest encoded in its name before it can be deleted.

Behavior

• Run it after a release as a serialized step with registry write credentials. --dry-run needs read access only.
• The rebuild drops index entries not backed by a _delta-* tag, including foreign entries.
• It is not wired into parallel push jobs.

Validation

• Tests cover removing a pre-seeded index entry, keeping live tags, removing an unreferenced source tag, and dry-run.
• A dry run against the public staging registry reported zero removals while the chain was intact.
• go test -race ./..., go vet, pre-commit, and integration pass.

Notes

• Action integration is a follow-up.