vendor-images.sh: skopeo never read CONTAINERS_REGISTRIES_CONF

Not a 1.22 change, as the last commit said: 1.16 ignored it too.

[skip ci]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/vendor-images.sh

@@ -15,7 +15,12 @@ set -uo pipefail
 
 mirror=${MIRROR:-forge.quinefoundation.com/quine-global-labs/mirror}
 # Read from upstream itself, not from the mirror registries.conf points at.
-export CONTAINERS_REGISTRIES_CONF=/dev/null
+# The flag, not CONTAINERS_REGISTRIES_CONF: podman and buildah read that
+# variable, but skopeo never has. Until 2026-11-03 this exported it, skopeo
+# read the mirror, and every run copied the mirror onto itself, so tags
+# stayed at their first copy. (runner-x86-linux's skopeo now honors the
+# variable too; petersweb-infra, hosts/runner-x86-linux.)
+skopeo() { command skopeo --registries-conf /dev/null "$@"; }
 
 for ref in "$@"; do
   src="docker://$ref"

.forgejo/workflows/iso.yml

@@ -183,3 +183,7 @@ jobs:
         run: |
           rm -rf output release
           podman logout "$REGISTRY" || true
+          # Each build leaves ~100 GB of images and stages; the runner's daily
+          # prune keeps a day's worth, and a second build that day filled the
+          # disk. The next build pulls its bases from the forge again.
+          podman image prune -af >/dev/null || true