fix: allow graceful runner shutdown during stack maintenance

docker-compose.yml

@@ -44,12 +44,10 @@ services:
     #                  100.100.100.100 answers only for the tailnet and
     #                  SERVFAILs everything else -- getaddrinfo falls through.
     #
-    # --default-address-pool replaces the daemon default of fifteen /16s in
-    # 172.17-172.31, which a CI run exhausts ("all predefined address pools
-    # have been fully subnetted"): the host holds three, each lane creates its
-    # own network, and a killed job leaves one behind. 10.210/16 in /24s is 256
-    # networks and collides with nothing here (no 10.x route on the host; the
-    # tailnet is 100.64/10).
+    # Allocate 256 /24 subnets instead of Docker's large default /16 and /20
+    # subnets. Jobs and their sibling test stacks share this daemon's pool.
+    # The default bridge uses one slot. Interrupted cleanup can retain others;
+    # a larger pool provides headroom but does not replace network cleanup.
     command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false", "--dns=172.28.0.53", "--dns=1.1.1.1", "--default-address-pool", "base=10.210.0.0/16,size=24"]
     environment:
       DOCKER_TLS_CERTDIR: ""
@@ -79,6 +77,8 @@ services:
     image: docker.io/gitea/act_runner@sha256:7940221bcfc9df16f3401ddafb2231bf98bba5517bc381224c7a2c504b558974
     container_name: gitea-runner-wsl
     restart: unless-stopped
+    # Longer than runner.shutdown_timeout so cancellation can clean up too.
+    stop_grace_period: 6m
     depends_on:
       dind:
         condition: service_healthy