ci: bust the re-poisoned cargo cache (v3) + burst-guard the runner prune

This session's push storm refilled the runner to 100% WITHIN the prune timer's 24h window
(it only trims >24h), so a build hit ENOSPC and actions/cache saved a truncated target/ ->
`error[E0463]: can't find crate for shlex` in ci.yml's clippy. Two fixes:

- Bump cargo-target-v2- -> v3- in ci.yml + deb.yml so the poisoned tarball is bypassed (a
  suffix bump can't — restore-keys falls back to the old prefix; same as the v1->v2 fix).
- Harden scripts/ci/docker-prune: run HOURLY (was 6h) with a burst guard — if the disk is
  still >85% after the normal until=12h trim, prune ALL idle images + build cache (in-use
  protected). A fast push-burst can fill 99 GB inside any time window, so the disk-pressure
  trigger, not the age filter, is the real backstop. Applied live on home-runner-1 (reclaimed
  95%->66%) and checked in.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/ci/docker-prune.service

@@ -2,12 +2,14 @@
 #
 # Why this exists: every CI push builds and sha-<commit>-tags a Docker image per pipeline
 # (rust-ci, web, docs, fedora-rpm, fedora44-rpm, ...). Those tags are never dangling, so a
-# plain `docker image prune` SKIPS them and they accumulate forever — that is what filled the
-# disk (589 images / ~85 GB, builds failing on ENOSPC). This trims everything older than 24h;
-# images IN USE by a running container are always protected regardless of age.
-#
+# plain `docker image prune` SKIPS them and they accumulate — that is what filled the disk.
 # Host-level, not per-repo CI, because the runner is shared (punktfunk + other orgs all benefit).
 #
+# Two tiers: trim anything older than 12h normally, AND — because a push-burst can fill 99 GB
+# WITHIN that 12h window (a fast iteration session hit 100% and poisoned the cargo cache with a
+# truncated, half-saved target/) — a burst guard that prunes ALL idle images + cache once the
+# disk is >85% full. Images IN USE by a running container are always protected.
+#
 # Install on the runner host (root):
 #   cp scripts/ci/docker-prune.{service,timer} /etc/systemd/system/
 #   systemctl daemon-reload && systemctl enable --now docker-prune.timer
@@ -22,7 +24,10 @@ After=docker.service
 [Service]
 Type=oneshot
 # '-' prefix: each step is independent — a no-op/failure never blocks the others.
-ExecStart=-/usr/bin/docker image prune -af --filter until=24h
-ExecStart=-/usr/bin/docker builder prune -af --filter until=24h
-ExecStart=-/usr/bin/docker buildx prune -af --filter until=24h
-ExecStart=-/usr/bin/docker container prune -f --filter until=24h
+ExecStart=-/usr/bin/docker image prune -af --filter until=12h
+ExecStart=-/usr/bin/docker builder prune -af --filter until=12h
+ExecStart=-/usr/bin/docker buildx prune -af --filter until=12h
+ExecStart=-/usr/bin/docker container prune -f --filter until=12h
+# Burst guard: if STILL >85% full, prune every idle image + all build cache (in-use protected),
+# so a push-storm can't drive CI into ENOSPC (which truncates and poisons the actions/cargo cache).
+ExecStart=-/bin/sh -c 'P=$(df --output=pcent / | tr -dc 0-9); [ "$P" -ge 85 ] && { docker image prune -af; docker builder prune -af; docker buildx prune -af; } || true'