feat(workflows)!: step 5, clean up PR tags of every discovered image

[seantronsen]

Description

Step 5 of the v4 stack (on top of #44). Decouples pr-registry-cleanup the same way #44 decouples Trivy, so repos that publish more than one image get every image's PR tags cleaned up.

• Image names come from actions/discover-ghcr-images (feat(workflows)!: step 4, scan every published image with Trivy #44), verified to exist.
• One cleanup job per image (matrix); deletes pr-<N> and pr-<N>-<qualifier> tags, never pr-123.
• Failures are loud: every failed delete is logged, then the job fails.
• Skips fork PRs; fails on non-pull_request triggers.

Breaking: removes the pr-number and tag-prefix inputs (the tag is always pr-<N>, as build-release-goreleaser publishes it), and callers must grant contents: read alongside packages: write.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass (actionlint, zizmor)
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

🤖 Generated with Claude Code

[seantronsen]

See OpenCHAMI/github-actions-testbed#9
for test results.

[synackd]

Initial review, rebase needed to eliminate stale history.

[synackd]

URL encoding. See #44 (comment)