ci: pin the smoke image with a running container during the test

The label only protects against reclaims that honour it. The runner
hosts also run jobs we do not control: runner-2 has a second act_runner
registered with gitea.egl.lan on the same Docker daemon, and
opencode-devbox's workflows run raw `docker system prune -af` in 7
places. No prune removes an image a running container uses, so the
smoke step now starts a holder (`ci-reclaim-docker.sh hold`: --rm,
--network none, sleep 3600) right after the preflight, and the
always() cleanup step runs `release` (holder + image). Unprotected now:
only the seconds between the build step's load and the holder starting.

Verified on an isolated docker:29-dind: an unlabelled held image survives
raw system prune and image prune -af (control without holder: deleted);
hold fails on a missing image; holder is AutoRemove + network none;
release removes holder and image; reclaim behaviour unchanged.

.gitea/workflows/docker-publish.yml

@@ -658,13 +658,18 @@ jobs:
           EXPECTED_NODE_MAJOR=$(sed -n 's/^ARG NODE_VERSION=\([0-9][0-9]*\).*/\1/p' Dockerfile.base)
           export EXPECTED_NODE_MAJOR
           bash scripts/ci-reclaim-docker.sh assert-protected "$SMOKE_IMAGE"
+          # Pin the image with a running container for the whole test, so a
+          # raw prune from a job we do not control (other repos, the other
+          # Gitea instance's runner on the same VM) cannot remove it either.
+          bash scripts/ci-reclaim-docker.sh hold "$SMOKE_IMAGE"
           bash scripts/smoke-test.sh "$SMOKE_IMAGE"
-      # The label keeps this image from every job's reclaim, so it is removed
-      # here instead. A job killed before this step leaves an orphan, which the
-      # reclaim's age sweep deletes once it is older than SMOKE_IMAGE_MAX_AGE.
+      # The label keeps this image from every job's reclaim and the holder pins
+      # it, so both are removed here. A job killed before this step leaves an
+      # orphan: the holder exits after 1 h, and the reclaim's age sweep deletes
+      # the image once it is older than SMOKE_IMAGE_MAX_AGE.
       - name: Remove smoke image
         if: always()
-        run: docker image rm "$SMOKE_IMAGE" || true
+        run: bash scripts/ci-reclaim-docker.sh release "$SMOKE_IMAGE"
 
   # ── Phase 3b: amd64 smoke for the studio variant ────────────────────
   # Additive + independent of the core `smoke` job: gates ONLY
@@ -737,13 +742,18 @@ jobs:
           EXPECTED_NODE_MAJOR=$(sed -n 's/^ARG NODE_VERSION=\([0-9][0-9]*\).*/\1/p' Dockerfile.base)
           export EXPECTED_NODE_MAJOR
           bash scripts/ci-reclaim-docker.sh assert-protected "$SMOKE_IMAGE"
+          # Pin the image with a running container for the whole test, so a
+          # raw prune from a job we do not control (other repos, the other
+          # Gitea instance's runner on the same VM) cannot remove it either.
+          bash scripts/ci-reclaim-docker.sh hold "$SMOKE_IMAGE"
           bash scripts/smoke-test.sh "$SMOKE_IMAGE"
-      # The label keeps this image from every job's reclaim, so it is removed
-      # here instead. A job killed before this step leaves an orphan, which the
-      # reclaim's age sweep deletes once it is older than SMOKE_IMAGE_MAX_AGE.
+      # The label keeps this image from every job's reclaim and the holder pins
+      # it, so both are removed here. A job killed before this step leaves an
+      # orphan: the holder exits after 1 h, and the reclaim's age sweep deletes
+      # the image once it is older than SMOKE_IMAGE_MAX_AGE.
       - name: Remove smoke image
         if: always()
-        run: docker image rm "$SMOKE_IMAGE" || true
+        run: bash scripts/ci-reclaim-docker.sh release "$SMOKE_IMAGE"
 
   # ── Phase 4: multi-arch publish ─────────────────────────────────────
   build-variant:

.gitea/workflows/lint.yml

@@ -91,8 +91,8 @@ jobs:
         run: bash scripts/check-workflow-shell.sh .gitea/workflows
 
       - name: No raw docker prune in workflows (shared runner daemon)
-        # Jobs on the same runner share its Docker daemon (runner-a1 runs
-        # several docker-publish.yml jobs at once), and
+        # Everything on one runner host shares its Docker daemon (runner-a1
+        # runs several jobs at once; runner-2 also serves gitea.egl.lan), and
         # a bare `docker system prune -a` in one job deletes the smoke image
         # another job is testing (v1.12.2 run 740 shipped without its -studio
         # tags that way). Reclaim goes through scripts/ci-reclaim-docker.sh,