run by `ContainerExpirationPolicyWorker` by excluding policies
that are not linked to any container repositories