Cleanup old PR builds in ECR

PR images are temporary and should be cleaned up after PRs are closed or after some retention period.
Without cleanup, ECR will accumulate unnecessary images.

### Proposal
- Add a **GitHub Action on `pull_request.closed`** that deletes images tagged with `pr-*`.
- Add an **ECR lifecycle policy** to prune old PR images:
- Keep last N builds (e.g., 5) per PR tag.
- Expire the rest automatically.

### Acceptance Criteria
- [ ] Closed PRs no longer have active `pr-` images in ECR.
- [ ] ECR lifecycle policy is in place to limit total PR builds retained.
- [ ] Release images (`latest`, `latest-snapshot`, and version tags) are not affected.