Problem

Managing the OCI image cache (~/.cache/broodbox/images/) currently requires knowing the XDG paths and manually running rm -rf. After rebuilding guest images, stale rootfs entries accumulate on disk (each ~800MB) and the only automatic cleanup is the 7-day TTL eviction on startup.

Proposal

Add a bbox cache subcommand with basic cache management operations:

bbox cache list    # Show cached images: digest, size, last-used time, which refs point to them
bbox cache gc      # Remove entries not referenced by any current ref in the index
bbox cache purge   # Remove everything (nuclear option)

bbox cache list

Walk ~/.cache/broodbox/images/ and display:

• Each sha256-* rootfs entry with its size and mtime
• Which refs/ entries (image references) point to each digest
• Orphaned entries (no ref pointing to them)
• Layer cache size summary

bbox cache gc

Reachability-based garbage collection:

1. Walk refs/, build the set of live digests
2. Remove any sha256-* entry not in the live set
3. Optionally also sweep orphaned layer cache entries

bbox cache purge

Remove the entire ~/.cache/broodbox/images/ directory.

Notes

• The cache layout is owned by go-microvm's image.Cache type. The gc logic could live upstream in go-microvm as a Cache.GC() method, or downstream in brood-box by walking the directory directly.
• Concurrent safety: if another bbox process is actively cloning from a cache entry during GC, the clone may fail. For the CLI subcommand this is acceptable (user-initiated action), but document the caveat. A future enhancement could use flock-based locking.