deb,config: keep the newest and the newest successful staged trees

The retention kept the newest five staged trees per target, so the
staged trees of a kernel-scale target alone could hold three-digit
GiB. The policy is now the pair that earns its disk: the newest
staged tree (what a failed run is re-forked from explicitly) and the
newest successful one (what the next --incremental run forks
automatically) — one record when they coincide; every other staged
tree degrades to metadata-only at the next build's retention. The
retention decision moved into a pure planner over (success, size) so
the policy is table-testable.

The size cap no longer drops a tree outright: an --incremental run's
own tree is always kept by its own run — the user asked for a carried
tree, and at least one always exists — and the cap only thins the kept
pair while another member covers the resume, the newest successful
tree being the last one standing. Oversized trees left by older pkh
versions or interrupted builds come down at the next build's
retention, once their lock is free.

The cap moves to the first user settings file, config.yml in
~/.config/pkh (YAML, like the data files; missing file or keys mean
defaults, a corrupt file is backed up, PKH_STAGED_MAXSIZE overrides),
replacing the JSON sketch from the previous commit. Default 20G, 0
disables the size rule. Every retained tree's size is measured once at
retention and recorded in the manifest, so sweeps never re-walk the
trees.

src/prune.rs

@@ -16,8 +16,8 @@
 //!   record retention window plus the corrupt leftovers, `--all`
 //!   removes every record — recent builds and staged trees included,
 //!   which is where the space is. A record a live build holds the lock
-//!   of is never prunable, whatever the policy (at most five staged
-//!   trees per target are kept by `pkh deb` itself).
+//!   of is never prunable, whatever the policy (the newest and the
+//!   newest successful staged trees per target are kept by `pkh deb`).
 //! - **Shared apt download caches** under `/var/tmp/pkh/apt-cache/`
 //!   (see [`crate::deb::ephemeral::apt_cache_dir`]): the default policy
 //!   removes the ones untouched for longer than the retention window,