fix(ops): align stale job cleanup thresholds

docs/LOGBOOK.md

@@ -1607,7 +1607,8 @@ psql $DATABASE_URL -f apps/api/migrations/cleanup_duplicate_deprecated_playbooks
 | `2e128f9` | Gitea Code Review stale-run guard，避免快速連推堆疊多個 runner job |
 | `3b73cc7` | CD paths 收斂，workflow-only commits 不再觸發完整 image build/deploy |
 | `7d45f0c` | Docker textfile 補 `docker_container_started_seconds` + `DockerGiteaActionsJobStale` |
-| `pending` | 110 stale Gitea Actions job dry-run cleanup script + runbook/alert annotation |
+| `5e625f7` | 110 stale Gitea Actions job dry-run cleanup script + runbook/alert annotation |
+| `pending` | stale job cleanup policy thresholds aligned with workflow/job timeout buffers |
 
 ### 下一步
 

docs/runbooks/HOST-RESOURCE-BASELINE-110-188.md

@@ -61,7 +61,7 @@ Use these thresholds for alerting and AI triage:
 9. Runner services are part of the resource baseline even when jobs run outside Docker. Export `systemd_unit_*` metrics for all `actions.runner.*` services.
 10. CI runner limits must be set at the systemd unit level. Docker container limits do not protect host load from runner listener, worker, and `act` helper processes.
 11. Workflow-only commits must not trigger full CD image builds; CD should run only when runtime inputs change.
-12. Stale Gitea Actions cleanup must be dry-run first. Use `--apply` only when the container is older than the workflow timeout and has no recent useful logs.
+12. Stale Gitea Actions cleanup must be dry-run first. Use `--apply` only when the container is older than its workflow/job policy threshold and has no recent useful logs.
 
 ## Next Safe Rollout Order