Evict the shared check install cache by age or size (<data>/check-install/<repo>/bun) #7574

Since #7543 the forge fills <data>/check-install/<repo>/bun on the host from every contained check's bun.lock — every pull's, forks' included — and nothing ever removes an entry. The cache grows by the union of every package version any checked commit of the repository has locked; it is bounded only by the disk.

Evict it: a package directory whose last lend (or mtime) is older than N days goes, or the oldest go once the repository's cache passes a size cap. Do it under the existing fill lock (src/checks/install_cache.ts) so a fill or a lend never sees a half-removed package, off the request path, and say the bound in docs/APPS.md. A test fills two versions, ages one, evicts, and proves the next check still installs the other offline.

Split from review of #7568 (#7541).

Parked by the crew: the run ended without a pull: declined: #7574 depends on code that isn't on main yet, so I can't do it on this branch.