Retire promoted release candidates older than the newest two

[arzafran]

What this does

Stops the releases page from filling up with old release candidates. Every ship promotes a rolling-candidate-<build> prerelease to rolling, but nothing ever deleted the promoted candidates, so nine of them (110 MB each) were sitting there this morning. After this change each successful ship deletes promoted candidates older than the two newest, keeping the current build and one previous build for rollback.

Summary

• scripts/publish_rolling_release.sh: new retire_promoted_candidates, run once after a successful promotion. It deletes published, non-immutable candidates with a build strictly lower than the finalized one, except the newest PROGRAMA_RETAINED_CANDIDATES (default 2), using gh release delete --cleanup-tag so the tag goes too. The draft-only prune on the drift-repair path is unchanged.
• The finalized candidate and anything newer are never touched, so the appcast target stays intact.
• tests/test_rolling_release_publication.sh: two new cases, default window and PROGRAMA_RETAINED_CANDIDATES=1. All release shell tests and the 209 node tests pass.
• CLAUDE.md release notes and CHANGELOG updated.

Test plan

• CI green.
• On the next main ship, the promote-rolling job deletes the candidates older than the newest two and the releases page shows three candidates at most (the new one plus two retained).