ci: pin the smoke image with a running container during the test

The label only protects against reclaims that honour it. The runner
hosts also run jobs we do not control: runner-2 has a second act_runner
registered with gitea.egl.lan on the same Docker daemon, and
opencode-devbox's workflows run raw `docker system prune -af` in 7
places. No prune removes an image a running container uses, so the
smoke step now starts a holder (`ci-reclaim-docker.sh hold`: --rm,
--network none, sleep 3600) right after the preflight, and the
always() cleanup step runs `release` (holder + image). Unprotected now:
only the seconds between the build step's load and the holder starting.

Verified on an isolated docker:29-dind: an unlabelled held image survives
raw system prune and image prune -af (control without holder: deleted);
hold fails on a missing image; holder is AutoRemove + network none;
release removes holder and image; reclaim behaviour unchanged.

.gitea/workflows/docker-publish.yml

@@ -658,13 +658,18 @@ jobs:
           EXPECTED_NODE_MAJOR=$(sed -n 's/^ARG NODE_VERSION=\([0-9][0-9]*\).*/\1/p' Dockerfile.base)
           export EXPECTED_NODE_MAJOR
           bash scripts/ci-reclaim-docker.sh assert-protected "$SMOKE_IMAGE"
+          # Pin the image with a running container for the whole test, so a
+          # raw prune from a job we do not control (other repos, the other
+          # Gitea instance's runner on the same VM) cannot remove it either.
+          bash scripts/ci-reclaim-docker.sh hold "$SMOKE_IMAGE"
           bash scripts/smoke-test.sh "$SMOKE_IMAGE"
-      # The label keeps this image from every job's reclaim, so it is removed
-      # here instead. A job killed before this step leaves an orphan, which the
-      # reclaim's age sweep deletes once it is older than SMOKE_IMAGE_MAX_AGE.
+      # The label keeps this image from every job's reclaim and the holder pins
+      # it, so both are removed here. A job killed before this step leaves an
+      # orphan: the holder exits after 1 h, and the reclaim's age sweep deletes
+      # the image once it is older than SMOKE_IMAGE_MAX_AGE.
       - name: Remove smoke image
         if: always()
-        run: docker image rm "$SMOKE_IMAGE" || true
+        run: bash scripts/ci-reclaim-docker.sh release "$SMOKE_IMAGE"
 
   # ── Phase 3b: amd64 smoke for the studio variant ────────────────────
   # Additive + independent of the core `smoke` job: gates ONLY
@@ -737,13 +742,18 @@ jobs:
           EXPECTED_NODE_MAJOR=$(sed -n 's/^ARG NODE_VERSION=\([0-9][0-9]*\).*/\1/p' Dockerfile.base)
           export EXPECTED_NODE_MAJOR
           bash scripts/ci-reclaim-docker.sh assert-protected "$SMOKE_IMAGE"
+          # Pin the image with a running container for the whole test, so a
+          # raw prune from a job we do not control (other repos, the other
+          # Gitea instance's runner on the same VM) cannot remove it either.
+          bash scripts/ci-reclaim-docker.sh hold "$SMOKE_IMAGE"
           bash scripts/smoke-test.sh "$SMOKE_IMAGE"
-      # The label keeps this image from every job's reclaim, so it is removed
-      # here instead. A job killed before this step leaves an orphan, which the
-      # reclaim's age sweep deletes once it is older than SMOKE_IMAGE_MAX_AGE.
+      # The label keeps this image from every job's reclaim and the holder pins
+      # it, so both are removed here. A job killed before this step leaves an
+      # orphan: the holder exits after 1 h, and the reclaim's age sweep deletes
+      # the image once it is older than SMOKE_IMAGE_MAX_AGE.
       - name: Remove smoke image
         if: always()
-        run: docker image rm "$SMOKE_IMAGE" || true
+        run: bash scripts/ci-reclaim-docker.sh release "$SMOKE_IMAGE"
 
   # ── Phase 4: multi-arch publish ─────────────────────────────────────
   build-variant: