TODO.md: log the post-upgrade old-kernel/obsolete-lib disk cleanup

Found missing during a docs/scripts recheck - everything else this
session has a dated entry, this cleanup pass didn't yet.

TODO.md

@@ -650,3 +650,24 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       third-party repos (`ondrej/php`, `rspamd.com`) a fresh build
       actually needs, plus this exact "release upgrade ≠ full upgrade"
       gotcha for next time.
+
+- [x] **Post-upgrade disk cleanup: old jammy kernel + obsolete libs left behind** — done 2026-07-26
+      Follow-up to the PHP/Docker fix above: the pre-upgrade jammy kernel
+      (`5.15.0-186-generic`, ~585MB installed - image, both header
+      packages, both modules packages) was still installed and still
+      present in the GRUB menu even though the box had been running
+      `6.8.0-136-generic` since the upgrade and had already been
+      rebooted/sanity-checked clean on it. `apt autoremove --dry-run`
+      separately flagged 8 small obsolete jammy-era libraries
+      (`libmagickcore`/`libmagickwand`/`libtiff5`/`libdav1d5`/etc.,
+      superseded by the noble builds pulled in for PHP) as safe to
+      remove.
+      Fixed: `apt-get purge` on the old kernel packages by exact name
+      (not caught by plain `autoremove` - kernels are deliberately kept
+      unless explicitly targeted), then `apt-get autoremove --purge` for
+      the obsolete libs, `apt-get clean` (220M), and `journalctl
+      --vacuum-time=2weeks` (56M). Verified: GRUB regenerated cleanly
+      listing only `6.8.0-136-generic`; `/boot` usage dropped from tight
+      to 12%; `sanity-check.sh` full pass (48/48) immediately after.
+      Root usage barely moved (already 10% with 136G free beforehand) -
+      this was dead-weight removal, not a space-pressure fix.