fix(os-update): keep the pacman package cache empty

pacman keeps every package an upgrade downloads. On edge-1's 6.6 GB eMMC
root that was 1.7 GB, leaving 197 MB free. The role now installs a pacman
hook that empties the cache after every transaction, and empties it
before the 1 GiB free-space check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/os-update/files/pacman-cache.hook

@@ -0,0 +1,14 @@
+# Managed by ansible (roles/os-update).
+# Downloaded packages are not kept; older versions come from the Arch Linux
+# Archive.
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Removing downloaded packages from the cache...
+When = PostTransaction
+Exec = /usr/bin/find /var/cache/pacman/pkg -mindepth 1 -delete

ansible/roles/os-update/tasks/main.yml

@@ -25,6 +25,34 @@
   check_mode: false
   when: os_update_docker.stat.exists
 
+# pacman keeps every downloaded package; on the edge hosts' 7 GB eMMC root
+# the cache grows to gigabytes.
+- name: Ensure the pacman hook directory exists (Arch)
+  ansible.builtin.file:
+    path: /etc/pacman.d/hooks
+    state: directory
+    mode: "0755"
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Empty the package cache after every transaction (Arch)
+  ansible.builtin.copy:
+    src: pacman-cache.hook
+    dest: /etc/pacman.d/hooks/pacman-cache.hook
+    mode: "0644"
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Empty the package cache (Arch)
+  ansible.builtin.command:
+    argv: [find, /var/cache/pacman/pkg, -mindepth, "1", -delete, -print]
+  register: os_update_pacman_cache
+  changed_when: os_update_pacman_cache.stdout | length > 0
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Re-read mounts after the cache cleanup
+  ansible.builtin.setup:
+    gather_subset: [mounts]
+  when: os_update_pacman_cache is changed
+
 - name: Assert at least 1 GiB free on /
   ansible.builtin.assert:
     that: >-