docs: add local Docker cleanup guidance

[Elodie Mirza (elodiejmirza)]

BLUF

• What changed: added end-of-task local Docker cleanup guidance to AGENTS.md.
• Why it changed: re-pullable images and build cache should not accumulate after Docker-backed tasks.
• User or developer impact: agents must verify remote digests and dependencies before scoped cleanup.
• Release impact: none.
• Security impact: reduces unsafe broad-prune and local-state retention risk.

Verification

• scripts/verify-docs.sh — not run; AGENTS.md is outside the release-doc gate.
• cargo test --all-features — not run; no Rust code changed.
• cargo clippy --all-targets --all-features -- -D warnings — not run; no Rust code changed.
• Secure code review completed with no open findings.

Security Checklist

• Untrusted input handling is unchanged.
• Raw packet behavior is unchanged.
• Malformed packet behavior is unchanged.
• No credentials, private packet data, or local-only artifacts are included.
• No dependency, workflow, or release change is introduced.

Notes

• Applied central lesson LL-0007: record what cleanup removed and preserved.
• Complexity removed or justified: one documentation block; no automation layer.
• No project update applies because release and roadmap state are unchanged.

[Copilot]

Pull request overview

Adds explicit guidance to AGENTS.md for scoped end-of-task local Docker cleanup to prevent accumulation of re-pullable images and build cache, while avoiding unsafe broad prune operations.

Changes:

• Documented an “End-Of-Task Local Docker Cleanup” checklist focusing on inventory, digest-verified removals, and scoped cleanup.
• Added explicit constraints to avoid removing unrelated Docker assets and to record what was removed/preserved.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.