fix(ops): add stale gitea job cleanup guard

scripts/ops/stop-stale-gitea-actions-jobs.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# 2026-05-05 ogt + Codex
+# Find or stop stale Gitea/act job containers on the 110 host.
+#
+# Default is dry-run:
+#   bash scripts/ops/stop-stale-gitea-actions-jobs.sh
+#
+# Apply after reviewing candidates:
+#   bash scripts/ops/stop-stale-gitea-actions-jobs.sh --apply
+#
+# Safety rules:
+# - Only touches Docker containers named GITEA-ACTIONS-*.
+# - Defaults to containers older than 20 minutes.
+# - Skips containers with recent log output unless --force is provided.
+
+MIN_AGE_SECONDS=1200
+APPLY=0
+FORCE=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --apply)
+      APPLY=1
+      shift
+      ;;
+    --force)
+      FORCE=1
+      shift
+      ;;
+    --min-age-seconds)
+      MIN_AGE_SECONDS="${2:?--min-age-seconds requires a value}"
+      shift 2
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+now="$(date +%s)"
+found=0
+
+while read -r name; do
+  [[ -n "$name" ]] || continue
+  started_raw="$(docker inspect "$name" --format '{{.State.StartedAt}}')"
+  started="$(date -u -d "$started_raw" +%s 2>/dev/null || echo 0)"
+  age=$((now - started))
+  [[ "$age" -ge "$MIN_AGE_SECONDS" ]] || continue
+
+  found=1
+  log_tail="$(docker logs --since 5m --tail 5 "$name" 2>&1 || true)"
+  has_recent_logs=0
+  if [[ -n "$log_tail" ]]; then
+    has_recent_logs=1
+  fi
+
+  printf 'candidate name=%s age_seconds=%s recent_logs=%s\n' "$name" "$age" "$has_recent_logs"
+  if [[ "$has_recent_logs" == "1" ]]; then
+    printf '%s\n' "$log_tail" | sed 's/^/  log: /'
+  fi
+
+  if [[ "$APPLY" == "1" ]]; then
+    if [[ "$has_recent_logs" == "1" && "$FORCE" != "1" ]]; then
+      echo "skip $name: recent logs exist; use --force only after manual review"
+      continue
+    fi
+    docker stop "$name"
+  fi
+done < <(docker ps --format '{{.Names}}' | grep '^GITEA-ACTIONS-' || true)
+
+if [[ "$found" == "0" ]]; then
+  echo "No stale Gitea Actions containers older than ${MIN_AGE_SECONDS}s."
+fi