Prune portable backup slot before export

platform/backup/athena-export-backup

@@ -37,6 +37,22 @@ target="$OUTPUT_DIR/$name"
 list=$(mktemp /tmp/athena-export-list.XXXXXX)
 trap 'rm -f "$list" "$partial"' EXIT
 
+# The encrypted export is roughly the size of its predecessor. Keeping all
+# generations until after writing the next one requires one extra archive of
+# free space and can deadlock a full backup disk. Release exactly one slot
+# before writing when the configured retention is already reached. If the new
+# export fails, KEEP-1 valid generations remain available.
+mapfile -t existing < <(find "$OUTPUT_DIR" -maxdepth 1 -type f \
+  -name 'athena-portable-*.tar.zst.age' -printf '%T@ %p\n' \
+  | sort -rn | cut -d' ' -f2-)
+while ((${#existing[@]} >= KEEP)); do
+  last_index=$((${#existing[@]} - 1))
+  oldest=${existing[$last_index]}
+  rm -f -- "$oldest" "$oldest.sha256"
+  unset 'existing[last_index]'
+  existing=("${existing[@]}")
+done
+
 add_path() {
   local path=${1#/}
   [[ ! -e /$path ]] || printf '%s\0' "$path" >>"$list"