fix(publish): keep images not yet moved to images/ in the registry

[ericwang401]

Problem

The published registry lists only Debian 13. 35ed5d6 moved uploads from templates/ to images/, and cf publish --r2 scanned only the configured prefix. On 2026-09-21 the upstream check rebuilt debian-13 under images/ and republished, which dropped the 15 images still under templates/. Those images are intact; every URL in the previous registry still returns 200.

Fix

• cf publish --r2 also lists LEGACY_PREFIXES (templates/) via publishPrefixes. The existing newest-per-template selection lets a rebuild under images/ supersede the legacy copy, and unmoved images keep their original URLs.
• Prune is unchanged: it scans only the configured prefix, so it never deletes legacy objects the registry references.
• The R2_PREFIX fallbacks in env.ts, publish.ts and maintenance.ts default to images/ instead of templates/.
• docs/setup.md and docs/usage.md describe images/ and the legacy prefix.

After merge

• Run a build or the upstream check to trigger publish and regenerate registry.json.
• If the bucket has the lifecycle rule the old setup doc suggested (templates/, 60 days), it will delete the legacy images around 2026-11-03 while the registry still points at them. Remove it or move it to images/.

Testing

• New publishPrefixes and legacy-supersession tests pass; bun run typecheck is clean.
• 16 shell-script tests (cf-cluster-templates, export post-processor, vmid_leased) fail identically on main without this change.
• Not run against the live bucket: no R2 credentials locally.