fix(reboot): require double key for host runner sentinel

scripts/reboot-recovery/awoooi-startup-110.sh

@@ -193,9 +193,9 @@ RUNNER_SERVICE="gitea-act-runner-host.service"
 RUNNER_ENABLE_SENTINEL="/run/awoooi-runner-host-enabled"
 START_GITEA_RUNNER_ON_BOOT="${AWOOOI_START_GITEA_RUNNER_ON_BOOT:-0}"
 START_GITEA_RUNNER_ALLOWED=0
-# The runtime operator sentinel is the explicit, reversible approval to keep
-# the host runner open during an authorized deployment window.
-if [ -e "$RUNNER_ENABLE_SENTINEL" ]; then
+# The runtime operator sentinel is the second key for an authorized deployment
+# window. A single env var or a stale sentinel alone must not reopen host CI.
+if [ "$START_GITEA_RUNNER_ON_BOOT" = "1" ] && [ -e "$RUNNER_ENABLE_SENTINEL" ]; then
     START_GITEA_RUNNER_ALLOWED=1
 fi
 if [ -x "$RUNNER_DIR/act_runner" ] && [ -f "$RUNNER_DIR/config.yaml" ]; then