chore: add low-risk disk anti-bloat policy

scripts/src/help.ts

@@ -18,7 +18,7 @@ export function rootHelp(): unknown {
       { command: "server swap status|ensure [--path /swapfile] [--size 2GiB] [--dry-run]", description: "Inspect or idempotently create host swap for low-memory main-server operation." },
       { command: "server logs [--tail-bytes N]", description: "Return bounded tails from file logs and docker logs." },
       { command: "server cleanup plan [--min-age-hours N] [--limit N]", description: "Dry-run Docker image cleanup plan only: list active/protected images, stale candidates older than the default 24h threshold, risk, estimated reclaim, and manual review commands without deleting anything." },
-      { command: "gc plan|run|db-trace --confirm [--logs-keep-days N] [--include-browser-cache]", description: "One-time main-server disk relief for logs, journald, Docker build cache, allowlisted /tmp artifacts and explicit trace telemetry retention; plan is read-only and run requires --confirm." },
+      { command: "gc plan|run|db-trace|policy [--confirm] [--logs-keep-days N] [--include-browser-cache]", description: "One-time main-server disk relief and low-risk anti-bloat policy for logs, journald, allowlisted /tmp artifacts and explicit trace telemetry retention; plan is read-only and run requires --confirm." },
       { command: "server rebuild <backend-core|frontend|dev-frontend-proxy|provider-gateway|todo-note|code-queue-mgr|project-manager|baidu-netdisk|oa-event-flow>", description: "Maintenance-only local Compose rebuild for reviewed main-server services; frontend standard release must use CI artifact plus deploy apply dev/prod artifact consumers." },
       { command: "provider attach <providerId> [--master-server URL] [--up] [--force] | provider triage <providerId> [--observed-error text] [--observed-scope scope] [--microservice id ...] [--full|--raw]", description: "Generate the minimal external provider-gateway env/compose bundle or run the low-noise read-only provider health triage contract." },
       { command: "ssh <route> [operation args...]", description: "Open a Host SSH / WSL SSH maintenance session through the provider-gateway bridge; route syntax such as `G14:k3s` or `D601:win/c/test` only locates distributed targets." },
@@ -263,7 +263,7 @@ function providerHelp(): unknown {
 
 function gcHelp(): unknown {
   return {
-    command: "gc plan|run|db-trace",
+    command: "gc plan|run|db-trace|policy",
     output: "json",
     usage: [
       "bun scripts/cli.ts gc plan",
@@ -273,6 +273,8 @@ function gcHelp(): unknown {
       "bun scripts/cli.ts gc run --confirm --include-browser-cache",
       "bun scripts/cli.ts gc db-trace plan --before-date 2026-05-25",
       "bun scripts/cli.ts gc db-trace run --confirm --before-date 2026-05-25 --vacuum-full",
+      "bun scripts/cli.ts gc policy plan",
+      "bun scripts/cli.ts gc policy install",
       "bun scripts/cli.ts gc plan --full",
     ],
     description: "Plan or execute bounded one-time main-server disk relief for file logs, Docker json logs, systemd journal, Docker BuildKit cache, allowlisted /tmp artifacts and explicitly scoped database trace telemetry retention.",
@@ -292,10 +294,12 @@ function gcHelp(): unknown {
       "--build-cache-all": "prune all Docker builder cache without an until filter",
       "--tmp-min-age-hours N": "delete allowlisted /tmp artifacts older than N hours; default 24",
       "--limit N": "number of candidates returned and executed by run when --full is not set; default 50",
+      "--result-limit N": "number of per-candidate run results returned when --full is not set; default 50",
       "--full|--raw": "return and run against all candidates rather than the default bounded page",
       "--include-browser-cache": "also remove repo-local .state/playwright-browsers cache",
       "db-trace --before-date YYYY-MM-DD": "plan or delete default trace telemetry event types before the date",
       "db-trace run --vacuum-full": "rewrite public.oa_events after deletion so df can reclaim disk; requires maintenance window",
+      "policy plan|install": "render or install journald caps and a daily file-log plus allowlisted /tmp low-risk gc systemd timer",
       "--no-file-logs|--no-docker-logs|--no-journal|--no-build-cache|--no-tmp|--no-db-summary": "disable one collector",
     },
     reference: "docs/reference/cli.md",