ci: don't fail deploys on a transient "prune already running" collision

cd-apps's post-deploy `docker image prune` runs under `set -euo pipefail`
after the containers are already swapped, so when it collides with a
concurrent deploy/disk-maintenance prune ("Error response from daemon: a
prune operation is already running") it fails an otherwise-successful
deploy (observed on the #587 planner deploy). The cleanup is best-effort;
disk-maintenance.yml is the real image-prune safety net.

- cd-apps: `docker image prune -af || true`.
- disk-maintenance: tolerate the same collision on its prune; the disk-%
  threshold check afterward stays the real failure gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/cd-apps.yml

@@ -177,8 +177,13 @@ jobs:
             # deploy from failing if Caddy itself is unhealthy.
             docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile || true
 
-            # Clean up
-            docker image prune -af
+            # Clean up (best-effort). This runs AFTER the containers are
+            # swapped + Caddy reloaded, so the deploy already succeeded —
+            # a transient "a prune operation is already running" collision
+            # with a concurrent deploy/disk-maintenance prune must NOT fail
+            # an otherwise-green deploy. disk-maintenance.yml is the real
+            # image-prune safety net.
+            docker image prune -af || true
             docker compose ps
 
             # Annotate deploy in Grafana. GRAFANA_SERVICE_TOKEN lives