[zfergus]

Description

Adds a Prune Caches workflow (.github/workflows/prune-caches.yml) that deletes older ccaches, keeping only the newest per key prefix and ref. No existing workflow changes.

• Since Fix stale ccache keys and slow Debug CI tests #301, every run saves its ccache under <prefix>-ccache-<run_id>, because cache entries are immutable. Restores only read the newest one.
• Each push to main saves about 3.3 GB across all workflows, and old copies stay until they go 7 days unused. The repo reached 12.0 GB, and GitHub's eviction has since trimmed it to 10.1 GB. Over the limit, eviction can also drop PR caches and fresh entries, undoing the warm builds from Fix stale ccache keys and slow Debug CI tests #301 and Build Windows Debug CI with /O2 /Ob1 #302.

Mechanism:

• Triggers on workflow_run (completed) of Build, Python, Coverage, CUDA, Docs and ODR Check, plus a daily schedule and workflow_dispatch.
• Lists all caches, groups them by ref and by key minus the trailing run ID (-ccache-[0-9]+$ only, so PantheonSim's toolkit cache is untouched), and deletes all but the newest in each group.
• Keeps the newest by creation time, so a cache saved during a prune is never deleted.
• concurrency: prune-caches collapses a burst of triggers into one running and one pending run.

Security

• Only this job holds actions: write. The build jobs keep the repo's read-only default token.
• This matters because the build jobs run third-party actions referenced by mutable tags (SimenB/github-actions-cpu-cores@v2, ilammy/msvc-dev-cmd@v1, Jimver/cuda-toolkit, codecov/codecov-action, JamesIves/github-pages-deploy-action) and compile dependencies downloaded through CPM. With actions: write, compromised code there could delete caches and logs, cancel runs, or dispatch docs.yml, which deploys to gh-pages without approval.
• The prune job never checks out the repository and runs only gh, so PR code never sees its token, including when a fork's PR triggers workflow_run.

Impact:

• A dry run of the exact --jq query against the current caches deletes 44 older copies (6.0 GB) and keeps 29 ccaches plus PantheonSim's, leaving about 4.1 GB.
• Old copies on PR refs (e.g. Rigid and Affine Body Dynamics #184's ODR caches) are pruned too.

Type of change

• Enhancement (non-breaking change which improves existing functionality)

How Has This Been Tested?

• Ran the workflow's gh cache list --jq query (gh's built-in jq) against the live cache list: 44 deletions, 43 on main and 1 on refs/pull/184/merge, with the newest kept in each of the 29 groups.
• The workflow parses as YAML, and the workflow_run names match the name: of all six workflows.
• workflow_run, schedule and workflow_dispatch only use the workflow file from the default branch, so this can't run before merge. After merge, it runs on the next CI completion or by manual dispatch.

Checklist

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings