Remove old images by ID after container updates, not just dangling prune

Tagged images are never caught by docker image prune -f. Collect OLD_IDs
during the pull loop and explicitly rmi them after rebuilds complete.

Docker_Essentials/docker_update.sh

@@ -257,6 +257,7 @@ START=$(date +%s)
 UPDATED=()
 UP_TO_DATE=()
 FAILED=()
+OLD_IMAGE_IDS=()   # old image IDs to explicitly remove after rebuilds
 SKIPPED=()
 
 for container in "${TARGET_CONTAINERS[@]}"; do
@@ -301,6 +302,7 @@ for container in "${TARGET_CONTAINERS[@]}"; do
         if [[ -n "$OLD_ID" ]] && [[ "$OLD_ID" != "$NEW_ID" ]]; then
             log "$ICON_DONE  $container — updated ✅ (${OLD_ID:7:12} → ${NEW_ID:7:12})"
             UPDATED+=("$container")
+            OLD_IMAGE_IDS+=("$OLD_ID")
         else
             log "$container — already up to date (${NEW_ID:7:12})"
             UP_TO_DATE+=("$container")
@@ -338,13 +340,17 @@ if [[ ${#UPDATED[@]} -gt 0 ]]; then
     done
 fi
 
-# ── Prune dangling images ─────────────────────────────────────────────────────
-# Old images become dangling after a pull lands a new digest. Prune here so
-# they don't accumulate across daily runs.
+# ── Remove old images ────────────────────────────────────────────────────────
+# Explicitly rmi by the IDs captured before each pull. Tagged images are never
+# caught by dangling-only prune, so this is the only reliable cleanup path.
+# Fall through to dangling prune to catch any leftovers from other update paths.
 if [[ "$DRY_RUN" == true ]]; then
-    warn "DRY RUN — would prune dangling images"
+    warn "DRY RUN — would remove ${#OLD_IMAGE_IDS[@]} old image(s) and prune dangling"
     PRUNED_SUMMARY="(dry run)"
 else
+    for _old_id in "${OLD_IMAGE_IDS[@]}"; do
+        docker rmi "$_old_id" >/dev/null 2>&1 || true
+    done
     PRUNED_OUTPUT=$(docker image prune -f 2>&1)
     [[ "$ENABLE_LOGGING" == "true" ]] && echo "$PRUNED_OUTPUT" | sed 's/^/  /'
     PRUNED_SUMMARY=$(echo "$PRUNED_OUTPUT" | grep -E "^Total reclaimed" || echo "nothing reclaimed")