Prune stale firmware cache versions after download

[JAORMX]

Summary

Fixes #12 — the firmware cache grew unbounded across go-microvm version bumps.

Each version bump creates a new ~/.cache/broodbox/firmware/<version>/ directory (~tens of MB), but only the version pinned in go.mod is ever used. Old version dirs were never deleted.

Approach

In downloadFirmware, after a successful fresh download (manifest written, firmware lock still held), call pruneStaleFirmwareVersions:

• Scan sibling entries under the cache root.
• Remove any directory whose name isn't the version just downloaded.
• Skip transient/temp entries: .firmware.lock (a file), firmware-*.tar.gz temp archives (files), and firmware-extract-* temp dirs (firmware- prefix guard).
• Runs only on a fresh download, never on a cache hit (nothing changed, no point scanning).
• Failures are logged at debug level and never propagated — the firmware is already cached successfully, so pruning is strictly best-effort.

The file lock is held throughout, so there are no concurrency concerns.

Also adds a task firmware-clean target to wipe the whole firmware cache manually (honors XDG_CACHE_HOME), as suggested in the issue.

Tests

• multiple stale versions removed; current version, lock file, and transient temp entries all preserved
• no-op when only the current version is present
• no panic when the cache root doesn't exist

Verified: task lint (0 issues), full task test passes (incl. -race).

🤖 Generated with Claude Code

[JAORMX]

Panel review — 3 axes, 4 reviewers

Ran a three-axis panel review (Spec / Standards / Domain) with the Domain axis fanned out to secure-code-reviewer, software-architect, devops-expert, and library-reuse-reviewer. Findings are inline as line-anchored comments; summary below.

Spec — ✅ clean

All five implementation requirements in issue #12 are satisfied (list cacheRoot, skip lock/temp entries, remove non-current version dirs, debug log per prune, failures don't fail the download). No scope creep — the task firmware-clean target is explicitly in scope. Call site is fresh-download-only with the flock held, matching the spec.

Standards — ✅ clean

SPDX headers present, log/slog exclusively, correct DDD layer (internal/infra/vm/, no domain/sandbox/client leakage), table-driven tests alongside code, imperative commit message.

Domain — 0 ship-blockers, 1 mechanical, 1 cross-confirmed Info, 1 polish

• [Medium] firmware-clean resolves the cache root differently from the Go code on macOS → silently no-ops on a supported platform. See Taskfile.yaml comment.
• [Info — cross-confirmed] firmware- prefix guard is magic-string coupled to the download temp prefixes. Two reviewers independently concluded it's defense-in-depth, not load-bearing (failure mode is "leaves garbage," not "deletes something needed"). Optional shared constant.
• [Info] Prune failures at Debug may hide a consistently-failing prune from default log output. Consider Warn for unexpected RemoveAll errors.

Most important single issue: the Medium macOS path drift in firmware-clean — the only finding that changes actual behavior on a supported platform. The Go-side change (pruneStaleFirmwareVersions) is sound; secure-code-reviewer verified no symlink/TOCTOU/path-traversal exposure under the actual threat model (0700 owner-only cache root, lock held, stdlib RemoveAll doesn't follow symlinks).

🤖 Generated with Claude Code