Reclaim runner disk before agent image builds

[fineas-bot]

Summary

• Reclaims preinstalled Android, .NET, and GHC toolchains only for the amd64 agent-image job.
• Applies the same bounded cleanup to read-only validation and reviewed publication.
• Leaves every runtime source, Dockerfile, package, chart, and image input unchanged.

Why

Centaur #80 image validation built every image except the amd64 agent image. That runner failed while unpacking TeX Live because the hosted runner filesystem was full. Arm64 passed. The GitHub App cannot rerun Actions jobs, and reviewed publication must have a green exact-head Image validation success check.

Verification

• Both workflow YAML files parse successfully.
• Reviewed-release, runnable-digest, and immutable-tag verifier tests pass.
• This PR image-validation run must prove the cleanup on the same hosted runner lane.