Add prune retention planning

docs/config.md

@@ -286,6 +286,7 @@ destinations:
 - `links`: optional public URL metadata policy.
 - `state`: optional destination state ownership policy.
 - `reconciliation`: optional managed-output reconciliation policy.
+- `retention`: optional managed-output retention policy.
 - `transfer`: optional destination comparison action policy.
 
 Destination ids must be unique within a pipeline.
@@ -448,6 +449,24 @@ destinations:
 
 `links.primary_url` is selected from the newly planned outputs for the current run. Retained outputs keep their prior output metadata and timestamps.
 
+## Retention Policy
+
+```yaml
+retention:
+  prune:
+    enabled: false
+    older_than: 168h
+    keep_latest: 3
+```
+
+- `retention.prune.enabled`: optional boolean. Default is `false`.
+- `retention.prune.older_than`: optional duration. When pruning is enabled, outputs older than this duration are eligible in prune planning.
+- `retention.prune.keep_latest`: optional non-negative integer. When pruning is enabled, this many newest managed outputs are preserved before age-based pruning is considered.
+
+When `retention.prune.enabled` is `true`, at least one of `older_than` or `keep_latest` is required. `older_than` must be greater than zero, and `keep_latest` must be zero or greater.
+
+Prune planning uses managed output `updated_at` timestamps from destination state. It is owner-scoped for shared-root state. The current implementation parses, validates, and plans pruning from this policy; it does not delete destination files.
+
 ## Transfer Policy
 
 ```yaml
@@ -504,6 +523,7 @@ Defaults are applied after YAML decoding and before validation:
 - `links.primary: auto` when a `links` block is present and `primary` is omitted
 - `state.mode: single_owner`
 - `reconciliation.mode: replace`
+- `retention.prune.enabled: false`
 - `transfer.on_destination_same: skip`
 - `transfer.on_destination_older: replace`
 - `transfer.on_destination_newer: skip`