feat(image-tag-cleanup): add pure ephemeral-tag selection logic

[JSisques]

Summary

First of two PRs implementing image tag retention (see design.md D9, added in the next PR). trunk-ci-cd.yml publishes a new, uniquely-tagged image on every merge to main, with no branch-per-channel boundary to bound how many accumulate — this is the foundation for cleaning those up.

select-deletions.sh is pure decision logic, zero registry calls: given a JSON list of tag/version records on stdin, it decides which are safe to delete. It's unused by anything yet — the Docker Hub/GHCR wiring that calls it lands in the follow-up PR — but it's fully self-contained and independently testable.

Safety guarantee: an entry is only ever a deletion candidate when every tag it carries matches ephemeral_tag_prefix. A stable release, :latest, :edge, or a legacy :alpha/:beta/:X.Y.Z-alpha.N tag never matches, so it's never even considered — this holds regardless of retention_days/keep_min.

Chain Context

Field	Value
Chain	image-tag-cleanup
Tracker PR	Not needed (stacked)
Position	1 of 2
Base	main
Depends on	None
Follow-up	Docker Hub/GHCR wiring + reusable workflow + docs
Review budget	142 / 400

Chain Overview

main
 └── 📍 This PR: pure selection logic + tests
      └── Next PR: registry wiring + reusable workflow + docs

Test plan

• tests/image-tag-cleanup-select.test.sh — 9/9 passing (empty input, non-ephemeral tag protected, mixed-tag entry protected, untagged entry protected, keep_min floor respected, retention_days trigger, custom prefix, GHCR-shaped numeric id)
• shellcheck clean
• actionlint clean on test.yml