prune,docs: group the prune report by kind with sizes

The prune output spammed one line per path. The report now groups
entries by artifact kind with their total size, and the size is
measured before removal whatever the mode, so --dry-run prints a
digest ("24 residual build directories for 1.2 GiB") and both modes
end with the freed total. The size walk never crosses a mount point:
residual chroots hold bind-mounted /proc trees whose virtual files
(/proc/kcore alone reports 128 TiB) would poison the total.

--all is also honest now: it removes recent build records and staged
trees (that is where the space is), and the flag description says so.
One behavior fix rides along: a record or lock a live build holds was
previously prunable with --all, which would wreck a running build;
held locks are now out of bounds whatever the policy.

README.md

@@ -185,7 +185,10 @@ pkh deb --no-ccache     # build without the shared compile cache
 
 Each target keeps at most five staged trees: when a sixth is retained,
 the oldest degrades to a metadata-only record (manifest and log stay),
-and `pkh prune` removes records untouched for a week. `pkh deb
+and `pkh prune` removes records older than a week. `pkh prune --dry-run`
+previews everything it would remove, grouped by kind with sizes;
+`--all` ignores the age and removes everything a live build does not
+hold, recent records and staged trees included. `pkh deb
 --incremental` never forks a record built for a different
 series/architecture.