deb,config: keep the newest and the newest successful staged trees

The retention kept the newest five staged trees per target, so the
staged trees of a kernel-scale target alone could hold three-digit
GiB. The policy is now the pair that earns its disk: the newest
staged tree (what a failed run is re-forked from explicitly) and the
newest successful one (what the next --incremental run forks
automatically) — one record when they coincide; every other staged
tree degrades to metadata-only at the next build's retention. The
retention decision moved into a pure planner over (success, size) so
the policy is table-testable.

The size cap no longer drops a tree outright: an --incremental run's
own tree is always kept by its own run — the user asked for a carried
tree, and at least one always exists — and the cap only thins the kept
pair while another member covers the resume, the newest successful
tree being the last one standing. Oversized trees left by older pkh
versions or interrupted builds come down at the next build's
retention, once their lock is free.

The cap moves to the first user settings file, config.yml in
~/.config/pkh (YAML, like the data files; missing file or keys mean
defaults, a corrupt file is backed up, PKH_STAGED_MAXSIZE overrides),
replacing the JSON sketch from the previous commit. Default 20G, 0
disables the size rule. Every retained tree's size is measured once at
retention and recorded in the manifest, so sweeps never re-walk the
trees.

src/deb/mod.rs

@@ -258,10 +258,10 @@ pub enum Incremental {
     #[default]
     Off,
     /// `--incremental`: fork the auto-selected base — the newest
-    /// successful record of this identity among the last five carrying
-    /// a staged tree — and retain the new record's staged tree. With no
-    /// candidate the build runs from scratch and its record becomes
-    /// the identity's first base.
+    /// successful record of this identity carrying a staged tree — and
+    /// retain the new record's staged tree. With no candidate the build
+    /// runs from scratch and its record becomes the identity's first
+    /// base.
     Auto,
     /// `--incremental <id>`: fork that exact record (unique id or
     /// prefix, restricted to the records of this host tree; a FAILED