fix(webapp): guard asset carry-forward retention and prefer latest as semver fallback

The 14-day prune depends on the builder preserving mtimes through COPY.
Assert the outcome instead of the mechanism: fail the image build if
public/build exceeds 1GB, so silent retention failure becomes a loud CI
error. Also try :latest before :main when resolving the previous image,
so semver releases carry forward their true predecessor's assets.

Author: kathiekiwi

.github/workflows/publish-webapp.yml

@@ -117,10 +117,12 @@ jobs:
         id: prev_image
         # Previous image whose /build assets the Dockerfile carries forward.
         # Prefer the tag being published (mutable tags still point at the
-        # previous build here), fall back to `main`; if neither exists the
-        # Dockerfile default makes the carry-forward a no-op.
+        # previous build here); for fresh immutable/semver tags fall back to
+        # `latest` (the previous release — its users hold the stale HTML),
+        # then `main`. If nothing exists the Dockerfile default makes the
+        # carry-forward a no-op.
         run: |
-          for candidate in "${IMAGE_REPO}:${TAG}" "${IMAGE_REPO}:main"; do
+          for candidate in "${IMAGE_REPO}:${TAG}" "${IMAGE_REPO}:latest" "${IMAGE_REPO}:main"; do
             if docker manifest inspect "$candidate" >/dev/null 2>&1; then
               echo "prev_image=${candidate}" >> "$GITHUB_OUTPUT"
               echo "Using previous image: ${candidate}"

docker/Dockerfile

@@ -101,6 +101,14 @@ COPY --from=prev-assets --chown=node:node /triggerdotdev/apps/webapp/public/buil
 RUN find ./apps/webapp/public/build -type f -mtime +14 -delete \
     && find ./apps/webapp/public/build -type d -empty -delete
 COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/public ./apps/webapp/public
+# Guard against silent retention failure (e.g. a builder that stops
+# preserving mtimes, making the prune a no-op): fail the build loudly if the
+# carried-forward window grows past a size no healthy 14-day window can reach.
+RUN size_mb=$(du -sm ./apps/webapp/public/build | cut -f1) \
+    && if [ "$size_mb" -gt 1024 ]; then \
+         echo "public/build is ${size_mb}MB (>1024MB): asset carry-forward is not being pruned" >&2; \
+         exit 1; \
+       fi
 COPY --from=builder --chown=node:node /triggerdotdev/scripts ./scripts
 
 # Goose and schemas