Add weekly prune of old -preview package versions

[ChrisonSimtian]

The org ran out of shared storage. Cause is GitHub Packages, not Actions artifacts.

Problem

GitHub Packages has no retention-policy feature — no TTL, no auto-expiry, nothing to configure. publish-packages-preview.yml pushes the full package set on every main commit (ADR-0004), so versions accumulate without bound. Current state: 23 packages × ~72 versions ≈ 1,650 versions.

Only private packages are billed. 22 of the 23 are private (~885 MB) against a 500 MB free-plan quota — 1.8× over. Fallout.Common alone is 646 MB of it.

Actions artifacts are not implicated: 30 MiB total, and the one uploader already sets retention-days: 7.

Change

Weekly (+ on-demand) prune keeping the newest 20 -preview versions per package.

• Protects GA, -rc.N, and legacy -alpha.N via ignore-versions — verified against the live feed, only previews are eligible.
• Discovers packages from the API instead of hard-coding, so new packages are covered on first publish. New packages default to private, which is how this went unnoticed.
• Dry-run by default on manual dispatch, with a per-package report. Scheduled runs prune for real.
• Orders by creation date, not version number — deliberate, because the feed currently holds two preview schemes (see below).

Effect: prunes 1,098 versions, private storage ~885 MB → ~270 MB, back under quota.

Notes

• Deletion is irreversible — dispatch once with dry-run=true before letting the schedule run.
• This is mitigation, not the root fix. Making the 22 packages public makes their storage free outright (Fallout.GlobalTools is already public, which is why its 1.3 GB costs nothing). Visibility is UI-only per package, so it is not scriptable here.
• Unrelated bug spotted: version.json on main is 10.0.0-preview.{height}, so main publishes 10.0.0-preview.18 — the preview version went backwards from 2026.1.0-preview.156 and no longer matches the CalVer scheme documented in AGENTS.md / ADR-0004. Worth a separate issue.

[ChrisonSimtian]

Update: the 22 private packages have now been flipped to public (all 23 NuGet packages verify as `public` via the API). Billed Packages storage is ~0, so the org is out of the overage.

That changes this PR from quota-critical to hygiene: it is no longer needed to get under the limit, but still worth having — ~1,650 per-commit preview versions is unmanageable noise, and any new package will publish as private by default, which is exactly how this went unnoticed.

Two corrections to the description above:

• Package settings live at /orgs/{org}/packages/nuget/{name}/settings — no /package/ segment (that shape 404s). The package page itself is /{org}/{repo}/pkgs/nuget/{name}.
• "not scriptable here" was wrong about the UI being the only option in practice — it is UI-only in the sense that no REST/GraphQL mutation exists (GraphQL exposes only deletePackageVersion), but the flow automates fine via Playwright: Change visibility → Public → type package name to confirm → submit.

[ChrisonSimtian]

leaving this open for now, I made those packages public so problem solved for now but at some point I'd like to tidy up and have some housekeeping.
Would also be cool to have this as a fallout based workflow, not a claude hand cranked the yml file workflow