docker-build.yml: push :latest only + clean up host build images

- drop per-commit :sha tag (registry stays one tag per repo)
- remove the built image and prune dangling layers after push so CI builds
  stop accumulating orphan images on the Unraid host

.gitea/workflows/docker-build.yml

@@ -7,9 +7,7 @@ on:
 
 jobs:
   build:
-    # Run directly on the forgerunner host: the bundled Docker CLI and the
-    # mounted /var/run/docker.sock are available, so no nested-container or
-    # socket juggling is needed.
+    # Runs on the forgerunner host: bundled Docker CLI + mounted /var/run/docker.sock.
     runs-on: host
     steps:
       - name: Checkout
@@ -26,6 +24,15 @@ jobs:
         run: |
           # gitea.repository is already "owner/repo" (e.g. jason/breedr).
           IMAGE="registry.alwisp.com/${{ gitea.repository }}"
-          docker build -t "${IMAGE}:latest" -t "${IMAGE}:${{ gitea.sha }}" .
+          docker build -t "${IMAGE}:latest" .
           docker push "${IMAGE}:latest"
-          docker push "${IMAGE}:${{ gitea.sha }}"
+
+      - name: Clean up build images on host
+        # Builds use the host Docker daemon, so the built image and replaced
+        # layers stay on the Unraid host unless removed. Drop our tag and prune
+        # dangling layers to stop orphan images piling up on the array.
+        if: always()
+        run: |
+          IMAGE="registry.alwisp.com/${{ gitea.repository }}"
+          docker image rm -f "${IMAGE}:latest" 2>/dev/null || true
+          docker image prune -f 2>/dev/null || true