feat(cli): add dv prune to remove stale containers

[ducks]

Problem: dv agents pile up. Each stopped container keeps its writable layer (often 1-3GB), and nothing removes them, so a machine ends up with dozens of agents nobody has run in weeks. Removing them by hand with plain docker skips dv's config cleanup and hooks, and it can't tell an abandoned agent from one holding work that was never pushed.

Solution: dv prune lists dv-owned containers (com.dv.owner=dv or recorded in config, any image) that are stopped and last ran longer ago than --older-than (default 14d; 2w and 36h also work). Last run is State.FinishedAt, or Created for a container that never started.

• Without --yes it only lists candidates, oldest first.
• With --yes each candidate is started briefly and its git checkouts (the effective workdir and each plugin) are checked for uncommitted changes, stashes and commits on no remote. Containers with work, or that can't be checked, are kept and reported; the rest are removed through dv remove, so config cleanup and hooks run.
• The selected agent, the default container and --keep names are never pruned.

Suitable for a scheduled dv prune --yes (systemd timer or cron).