ci: prune pnpm store before caching and purge PR caches on close (#5340)

The pnpm store cache saved by actions/setup-node's cache: 'pnpm' only ever
grows: cache keys are immutable, so every lockfile change saves a brand-new
store on top of the previous one and pnpm never drops old package versions
from it on its own. Two fixes:

- node-setup: run `pnpm store prune` after install, so each saved cache
  entry only contains what the current lockfile references instead of
  every version ever fetched.
- cleanup-caches.yml: delete a PR's caches when it closes/merges, following
  GitHub's documented pattern (docs.github.com/actions/.../caching-dependencies-to-speed-up-workflows).
  PR-branch caches are scoped to a ref that stops being used once the PR is
  gone, but GitHub never deletes them automatically, so they sit consuming
  the repo's 10GB quota until LRU eviction forces them out - which stalls
  the *next* cache save while eviction runs.

One-time cleanup: manually purged all 73 existing cache entries (10.72GB,
already over quota) via `gh cache delete` so both fixes start from a clean
slate.

Author: odinr

.github/actions/node-setup/action.yml

@@ -21,3 +21,11 @@ runs:
     - name: Install dependencies
       shell: bash
       run: pnpm install --frozen-lockfile
+
+    # Cache keys are immutable, so every lockfile change saves a brand-new
+    # store on top of the previous one and old package versions never get
+    # dropped. Pruning here keeps the saved cache scoped to what this
+    # lockfile actually needs instead of growing unbounded.
+    - name: Prune pnpm store
+      shell: bash
+      run: pnpm store prune

.github/workflows/cleanup-caches.yml

@@ -0,0 +1,39 @@
+name: Cleanup PR caches
+
+# Actions cache entries are scoped to the ref that created them and are never
+# deleted automatically when a PR branch goes away, so they keep consuming
+# the repo's 10GB quota until GitHub's LRU eviction forces it out - which
+# stalls the *next* cache save while eviction runs. Purge a PR's caches as
+# soon as it closes so the quota reflects only active branches.
+on:
+  pull_request:
+    types:
+      - closed
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  cleanup:
+    name: Delete caches for closed PR
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete caches
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge
+        run: |
+          echo "Fetching caches for $BRANCH"
+          cacheKeys=$(gh cache list --repo "$REPO" --ref "$BRANCH" --limit 100 --json id --jq '.[].id')
+
+          if [ -z "$cacheKeys" ]; then
+            echo "No caches found for $BRANCH"
+            exit 0
+          fi
+
+          for id in $cacheKeys; do
+            echo "Deleting cache $id"
+            gh cache delete "$id" --repo "$REPO" || true
+          done