feat(audit): chain rolling cadence with auto-prune apply

README.md

@@ -1648,13 +1648,13 @@ This command writes drift reports to:
 - `docs/plans/artifacts/phase0_baseline_live_backend_drift_<UTC-date>.md`
 - `docs/plans/artifacts/phase0_baseline_live_backend_drift_<UTC-date>.json`
 
-Cadence scheduling (example: every 6 hours via host cron) with rolling timestamp tags and drift check:
+Cadence scheduling (example: every 6 hours via host cron) with rolling timestamp tags, drift check, and automatic retention apply:
 ```bash
-0 */6 * * * cd /path/to/flynn && pnpm audit:phase0-baseline:live:refresh:drift:rolling >> ~/.local/share/flynn/phase0_baseline_refresh.log 2>&1
+0 */6 * * * cd /path/to/flynn && pnpm audit:phase0-baseline:live:refresh:drift:rolling:prune >> ~/.local/share/flynn/phase0_baseline_refresh.log 2>&1
 ```
 `audit:phase0-baseline:live*` scripts now default to the current UTC date tag when `--tag` is omitted.
 Use `audit:phase0-baseline:live:refresh:drift:rolling` when you want each cadence run to keep a distinct tag (`YYYY-MM-DD-HHMMSS`) so drift checks compare against a recent prior snapshot immediately.
-Use `audit:phase0-baseline:live:prune` for dry-run retention planning, and `audit:phase0-baseline:live:prune:apply` to prune older rolling-tag artifacts while keeping the newest snapshots per family.
+Use `audit:phase0-baseline:live:prune` for dry-run retention planning, and `audit:phase0-baseline:live:prune:apply` to prune older rolling-tag artifacts while keeping the newest snapshots per family. Retention depth defaults to `8` tags per family and can be overridden via `KEEP_PER_FAMILY=<n>`.
 
 Gateway-origin windows can be captured separately (for example when validating cancel paths):
 ```bash