feat(builder): every boot through the node-agent, every lost file counted, Steam cache

What a builder boot sees is now what a node does:
- First boots (untouched, or -as-deployed with exactly a new server's
  settings) are deployed by the node-agent's BootTest in keep mode; the
  builder only watches the console and inspects what's left. The Go copy of
  the deploy (its own docker run, mounts and startup prefix) is gone. It had
  drifted: it gave the image's VOLUME folders their own volumes, which nodes
  don't, so saves there looked safe while every start loses them.
- Files written outside /server and /data are counted whatever their type
  (it only counted config-like extensions, so .sav or .db saves went
  unseen), including the image's VOLUME folders; logs, pid and lock files
  and system folders are left out.
- Boot tests ask the server to stay up holdSec (60 s, test.yaml can set it)
  after its ready line and to listen on every published container port
  (needs the node-agent's matching BootTest).
- Steam apps are downloaded once per build into a gbr.cache volume and copied
  into each boot, so later boots only check the files (STEAM_CACHE=off).
- RUNNER.md no longer suggests docker system prune, which deletes the
  gbr-boottest network when nothing is using it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RUNNER.md

@@ -51,5 +51,15 @@ the org or repo, and the workflow passes it through (see the `env:` of the boot-
 
 ## Housekeeping
 
-Game images and SteamCMD downloads add up. A weekly `docker system prune -af --filter "until=168h"`
-(cron or a systemd timer) keeps the disk in check; each test removes its own container and volume.
+Game images and SteamCMD downloads add up; each test removes its own container and volume. Clean up
+weekly (cron or a systemd timer) with:
+
+```bash
+docker container prune -f
+docker image prune -af --filter "until=168h"
+docker volume prune -af --filter "label!=gbr.cache"
+```
+
+Not `docker system prune`: it also deletes the `gbr-boottest` network whenever no container is using it,
+and boot tests then refuse to run until `systemctl restart gbr-boottest-network`. Volumes labelled
+`gbr.cache` are the AI builder's Steam download cache.