chore: add Artifact Registry + GCS cleanup policies post-deploy

- Artifact Registry: keep last 3 images, delete anything >7 days old
- Cloud Build GCS bucket: 3-day object lifecycle rule
Keeps storage well within free tier (0.5 GB AR, 5 GB GCS).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Uttam-Mahata

.github/workflows/backend-deploy-gcf.yml

@@ -82,6 +82,60 @@ jobs:
           echo "url=$URL" >> $GITHUB_OUTPUT
           echo "GCF deployed at: $URL"
 
+      - name: Cleanup — Artifact Registry (keep last 3 images)
+        run: |
+          # Set cleanup policy on the GCF container repo — keep only 3 most recent,
+          # delete anything older than 7 days. Stays well within 0.5 GB free tier.
+          REPO="us-east1-docker.pkg.dev/rootaccessctf/gcf-artifacts"
+
+          # Wait briefly for the repo to exist after first deploy
+          sleep 5
+
+          gcloud artifacts repositories set-cleanup-policies gcf-artifacts \
+            --project=rootaccessctf \
+            --location=us-east1 \
+            --policy=<(cat <<'EOF'
+          [
+            {
+              "name": "keep-last-3",
+              "action": {"type": "Keep"},
+              "mostRecentVersions": {"keepCount": 3}
+            },
+            {
+              "name": "delete-older-than-7d",
+              "action": {"type": "Delete"},
+              "condition": {"olderThan": "604800s"}
+            }
+          ]
+          EOF
+          ) 2>&1 || echo "Cleanup policy skipped (repo may not exist yet on first deploy)"
+
+      - name: Cleanup — Cloud Build GCS artifacts (keep 3 days)
+        run: |
+          # Find the Cloud Build staging bucket and set a 3-day lifecycle rule
+          BUCKET=$(gcloud storage buckets list \
+            --project=rootaccessctf \
+            --filter="name~gcf" \
+            --format="value(name)" 2>/dev/null | head -1)
+
+          if [ -n "$BUCKET" ]; then
+            echo "Setting lifecycle on gs://$BUCKET"
+            gcloud storage buckets update "gs://$BUCKET" \
+              --lifecycle-file=<(cat <<'EOF'
+          {
+            "rule": [
+              {
+                "action": {"type": "Delete"},
+                "condition": {"age": 3}
+              }
+            ]
+          }
+          EOF
+            )
+          else
+            echo "No GCF build bucket found yet — skipping."
+          fi
+
       - name: Update Cloudflare Worker GCF_BASE secret
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}