packaging: keep only the most recent base backup

Every `base-pre-<stamp>` rollback tag pins a whole ~26 GB image, and they
were never retired: twenty builds had accumulated 245 GB of bases that
nothing would ever read. The flatten now keeps KEEP_BACKUPS (default 1)
and retires the rest, so there is always exactly one image to roll back
to. KEEP_BACKUPS=0 keeps none.

It also drops the intermediate `flat-<stamp>` tag by default
(KEEP_FLAT_TAG=1 to keep it): it points at the same image the base tag
does, so it frees nothing and only makes `docker image ls` unreadable.

Tested end to end against ubuntu:24.04 — a real export/import/verify
cycle in seconds rather than six minutes: config equality passes, the new
backup is made, three older ones are retired, and KEEP_BACKUPS=0 leaves
none.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0182DhR1eFNPQyGmDrpHbedY