ci: publish :latest + :c-<sha> on main, :dev on dev — nothing else (318 step 4)

The narrowing itself. Rule 145, narrowed 2026-08-28 once it was verified that
nothing pins: "a third name for the same thing is upkeep for a model we do
not run."

Gone:

  :2026.8.28  the per-artifact date tag from milestone 313 step 3. It shipped,
              it was verified on both branches, and its premise is gone. This
              is a withdrawal, not a correction — nothing about it was wrong.
  :main       a second moving name for whatever :latest already pointed at,
              justified by nothing but symmetry with :dev.

Kept, and note the inversion: :c-<sha> on main. Milestone 313 step 6 planned
to retire it on "haven't used, not important" — amended rule 145 makes it the
rollback unit and, with version tags gone, the only immutable identifier
left. #3139 is cancelled as superseded rather than quietly dropped.

No retention job is built. One already runs (#3157): a nightly Gitea
package_cleanup_rule with keep_count=10. Two consequences worth writing down.
Its keep_pattern protects any dotted-numeric tag, so the date tags this
commit stops minting would have been exempt from retention and accumulated
without bound — silently, in the direction of unbounded growth. That trap is
now dissolved rather than needing the pattern change #3139 planned. And
:c-<sha> IS prunable under that pattern, so the honest statement is that it
is the rollback unit for roughly the last 10 builds, not for every main
commit ever.

cmd_tag goes with its last consumer rather than being left as a dead
subcommand for a later step to notice. The report step logs version and
revision, which is the same information — the date is the first three fields
of the version.

Docs needed no change: every consumer already tracks a moving tag
(docker-compose.yml on :dev, agent/README.md on :latest), which is the
evidence the whole stance rests on.

scripts/artifacts.sh

@@ -58,7 +58,7 @@ AGENT_PATHS='agent/Dockerfile agent/requirements.txt agent/fc_agent'
 
 
 usage() {
-  echo "usage: artifacts.sh {paths|revision|version|tag} {web|ml|agent|extension}" >&2
+  echo "usage: artifacts.sh {paths|revision|version} {web|ml|agent|extension}" >&2
   exit 2
 }
 
@@ -137,24 +137,10 @@ cmd_version() {
     "$(strip0 "$(fmt "$sha" %H%M)")"
 }
 
-# The PUBLISHED IMAGE TAG: day precision, YYYY.M.D. Deliberately coarser than
-# the ordering key, per the operator 2026-08-28 — same-day work is not
-# something worth pinning, so a second build the same day replaces the first
-# rather than accumulating a tag nobody would roll back to. Safe only because
-# skip decisions key on cmd_revision, never on this.
-cmd_tag() {
-  sha=$(echo "$(newest "$1")" | cut -d' ' -f2)
-  printf '%s.%s.%s\n' \
-    "$(fmt "$sha" %Y)" \
-    "$(strip0 "$(fmt "$sha" %m)")" \
-    "$(strip0 "$(fmt "$sha" %d)")"
-}
-
 [ $# -ge 2 ] || usage
 case "$1" in
   paths)    cmd_paths "$2" ;;
   revision) cmd_revision "$2" ;;
   version)  cmd_version "$2" ;;
-  tag)      cmd_tag "$2" ;;
   *)        usage ;;
 esac