Runtime retention: prune obsolete runtimes under ~/.t3/runtime/versions after a committed update

[spiky02plateau]

Every update installs a new runtime under ~/.t3/runtime/versions and nothing removes the old ones (#8345).
On my Mac that is 20 runtimes and 6.8 GiB after six weeks of nightlies, about 0.3 to 0.7 GiB per update.
#7811 added t3 service prune and was closed for missing direction approval, so I am asking for direction here before writing code.

Proposed scope:

• After an update reaches committed, delete completed runtimes that nothing references.
• Keep the active version, update.fromVersion, any runtime of a pending update, and the runtime the service unit executes.
• Leave staging directories, symlinks, and unknown entries alone.

The last keep rule depends on #17490: the LaunchAgent or systemd unit stays pinned to the runtime that ran t3 service install, and service-state.json does not record it.
Fixing that first (re-render the unit after a remote update commits, or record its runtime in service-state.json) makes retention a pure function of service-state.json.

Questions for maintainers:

1. Automatic pruning on commit, an explicit t3 service prune, or both?
2. Should [Bug]: Service unit stays pinned to the runtime that installed it, so deleting old runtimes breaks the next restart #17490 land first as its own fix?
3. How many previous versions should be kept for rollback: one, or a setting?