ci(runner): drain legacy docker act runner safely

scripts/ci/cleanup-host-runner-workspace.sh

@@ -37,6 +37,17 @@ cleanup_artifacts() {
   rm -rf node_modules apps/web/node_modules 2>/dev/null || true
 }
 
+cleanup_empty_docker_network() {
+  local network="$1"
+  local containers_json
+
+  command -v docker >/dev/null 2>&1 || return 0
+  containers_json="$(docker network inspect "$network" --format '{{json .Containers}}' 2>/dev/null || true)"
+  [ "$containers_json" = "{}" ] || return 0
+
+  docker network rm "$network" >/dev/null 2>&1 || true
+}
+
 has_leftovers() {
   local root="$1"
   [ -d "$root/.pytest_cache" ] && return 0
@@ -53,6 +64,7 @@ has_leftovers() {
 }
 
 cleanup_artifacts "$ROOT"
+cleanup_empty_docker_network "b5-test-net"
 
 if has_leftovers "$ROOT" && [ -n "$CLEANUP_IMAGE" ] && command -v docker >/dev/null 2>&1; then
   echo "host cleanup left root-owned artifacts; retrying through ${CLEANUP_IMAGE}"

scripts/reboot-recovery/awoooi-startup-110.sh

@@ -228,8 +228,15 @@ PY
     fi
 
     # 已停用 Docker-wrapped runner；避免它搶走 host label job。
+    # 若手動執行此 recovery script 時仍有 task container，送 SIGINT
+    # 讓 act_runner drain，不再接新 job，並等手上的 job 收尾。
     docker update --restart=no gitea-runner >/dev/null 2>&1 || true
-    docker stop gitea-runner >/dev/null 2>&1 || true
+    if docker ps --format '{{.Names}}' | grep -q '^GITEA-ACTIONS-TASK-'; then
+        log "⚠️  Gitea Actions task container still running; draining docker-wrapped gitea-runner"
+        docker kill --signal=SIGINT gitea-runner >/dev/null 2>&1 || true
+    else
+        docker stop -t 3700 gitea-runner >/dev/null 2>&1 || true
+    fi
 
     sleep 15