How about prune all resources with `docker stack deploy --prune`

Prune currently removes services that are no longer referenced.

--prune                  Prune services that are no longer referenced

It might be nice to have similar functionality for other resources especially config files and secrets because changing either of these requires a new config file or secret which wouldn't be so bad if the old, unused ones were easily cleaned up. Maybe this could apply to networks and volumes too? Maybe we need a flag to opt in to what is pruned?

This would only apply to resources created by the stack, not externally created and not externally used resources. Also, this wouldn't apply to resources needed during a rolling update, for example the last version of a config file that's still in use, though that could be removed if the update completes successfully.

Start with the docker stack deploy --prune behavior described in the issue and compare how stack-created config files, secrets, networks, and volumes are tracked. Define the resource-pruning scope and opt-in behavior, including rolling-update and external-resource cases, before identifying implementation and test locations.