ci: prune rootless docker + trap container leaks in microvm build

Self-hosted runner accumulated 18GB in overlay2 from leaked container
layers. Two causes: build-microvm-image.sh only removed the alpine
container on the success path, and no workflow step pruned docker
between runs.

- scripts/build-microvm-image.sh: container id now removed via the
  existing EXIT trap, so failures, signals, and runner kills no longer
  leak the writable layer.
- .github/workflows/e2e-go.yml: prune containers / dangling images /
  buildx cache before each Build Install Artifacts step, in all three
  e2e jobs (single, multinode, reboot).

.github/workflows/e2e-go.yml

@@ -112,6 +112,16 @@ jobs:
         # Go self-heal by fetching the named minor on demand.
         run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
 
+      - name: Prune rootless docker cache
+        # Self-hosted runner uses rootless docker; build-microvm-image.sh
+        # leaks ~100 MiB overlay2 layer per failed build. Prune before each
+        # run keeps /home/<ciuser>/.local/share/docker bounded.
+        run: |
+          docker container prune -f || true
+          docker image prune -af || true
+          docker buildx prune -af --filter "until=24h" || true
+          docker system df || true
+
       - name: Build Install Artifacts
         working-directory: mulga/scripts/tofu-cluster
         run: |
@@ -443,6 +453,16 @@ jobs:
       - name: Re-enable Go toolchain auto-download
         run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
 
+      - name: Prune rootless docker cache
+        # Self-hosted runner uses rootless docker; build-microvm-image.sh
+        # leaks ~100 MiB overlay2 layer per failed build. Prune before each
+        # run keeps /home/<ciuser>/.local/share/docker bounded.
+        run: |
+          docker container prune -f || true
+          docker image prune -af || true
+          docker buildx prune -af --filter "until=24h" || true
+          docker system df || true
+
       - name: Build Install Artifacts
         working-directory: mulga/scripts/tofu-cluster
         run: |
@@ -799,6 +819,16 @@ jobs:
       - name: Re-enable Go toolchain auto-download
         run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
 
+      - name: Prune rootless docker cache
+        # Self-hosted runner uses rootless docker; build-microvm-image.sh
+        # leaks ~100 MiB overlay2 layer per failed build. Prune before each
+        # run keeps /home/<ciuser>/.local/share/docker bounded.
+        run: |
+          docker container prune -f || true
+          docker image prune -af || true
+          docker buildx prune -af --filter "until=24h" || true
+          docker system df || true
+
       - name: Build Install Artifacts
         working-directory: mulga/scripts/tofu-cluster
         run: |