To be elaborated on, but probably at harbor install/setup time
Note that there's a combo of policies for the toolforge project:
- Immutable tags: all but *dev-* are immutable
- Retention policy: For the repositories matching **, retain the most recently pushed 10 artifacts with tags matching *dev*
Then we have to manually keep the last 10 immutable images (like we do with maintain-harbor on tools-harbor currently).