fix(reboot): require double key for host runner sentinel

scripts/ci/wait-host-web-build-pressure.sh

@@ -7,7 +7,7 @@ set -euo pipefail
 # production host and a CI host, so CD must not start a new Docker/Next build
 # while load, BuildKit, Gitea Actions, or headless smoke pressure is already high.
 # This gate never kills, renices, or rewrites another repo's process tree.
-# 2026-06-28 Codex: CD trigger after opening the AWOOI runner pressure guard.
+# 2026-06-28 Codex: CD trigger after opening the AWOOI runner sentinel guard.
 
 ATTEMPTS="${HOST_WEB_BUILD_PRESSURE_ATTEMPTS:-${HOST_WEB_BUILD_PRESSURE_MAX_ATTEMPTS:-60}}"
 SLEEP_SECONDS="${HOST_WEB_BUILD_PRESSURE_SLEEP_SECONDS:-${HOST_WEB_BUILD_PRESSURE_INTERVAL:-10}}"

scripts/reboot-recovery/awoooi-startup-110.sh

@@ -193,6 +193,8 @@ RUNNER_SERVICE="gitea-act-runner-host.service"
 RUNNER_ENABLE_SENTINEL="/run/awoooi-runner-host-enabled"
 START_GITEA_RUNNER_ON_BOOT="${AWOOOI_START_GITEA_RUNNER_ON_BOOT:-0}"
 START_GITEA_RUNNER_ALLOWED=0
+# The runtime operator sentinel is the second key for an authorized deployment
+# window. A single env var or a stale sentinel alone must not reopen host CI.
 if [ "$START_GITEA_RUNNER_ON_BOOT" = "1" ] && [ -e "$RUNNER_ENABLE_SENTINEL" ]; then
     START_GITEA_RUNNER_ALLOWED=1
 fi