Graceful shutdown on SIGTERM + fix rootfs mount leak that wedges slots

[guifranchi]

Fixes #15. Draft for review discussion, not to be merged/deployed yet.

What

Two independent fixes, one per defect described in #15:

1. Graceful shutdown (new manager/src/shutdown.rs)

The v0.1.11 handler ignored SIGTERM/SIGINT (SigHandler::SigIgn), so the manager could never exit on a stop signal — every systemctl stop/restart hung for TimeoutStopSec and ended in systemd SIGKILLing the manager and all Firecracker VMs (how ci-hel3 ended up dead for 4 days).

Now: the signal sets an AtomicBool; a watcher thread SIGKILLs each registered Firecracker process group (they setsid() at spawn) so the slots' blocked child.wait() calls return; each slot loop observes the flag, runs teardown (stale-mount cleanup, PID file removal), and exits; the manager joins all slots and exits 0. The 20s boot-failure back-off is now interruptible, and reattached VMs (PID-file recovery path) are registered with the watcher too.

Design choice: running VMs are killed, not drained. Same job impact as today's SIGKILL, but with clean teardown and a fast, bounded stop. A drain-with-grace-period can be layered on later if wanted.

2. Rootfs mount leak

setup_run() fetched the GitHub registration token and injected config while the rootfs was mounted; any error in that window (a GitHub API hiccup is enough) returned with the mount still held. Mounts are kernel state. From then on every cycle fails lvcreate snapshot failed: ... contains a filesystem in use, retried every 20s forever. Three staging slots wedged this way in 5 days (appsignal/appsignal-ansible#806: ci-hel1 slot 0, ci-hel2 slot 7, ci-hel3 slot 6).

Fixes:

• registration token fetched before mounting (no network call can fail while mounted);
• unmount now also runs on the injection error path;
• each cycle defensively unmounts a stale mnt left by a crash/SIGKILL before touching LVM, so a wedged slot self-heals on the next cycle instead of requiring manual fuser -km/umount/lvremove.

Testing

• cargo check, cargo test --workspace (12 tests), cargo clippy, all clean.
• Not yet run on a real host. Suggested verification on one staging host after build: systemctl restart actions-runner mid-job --> unit stops in seconds, exits 0 (no Failed with result 'timeout'), no stale /srv/runners/*/*/mnt mounts, slots come back cleanly.

Related: #14 (cache LV fixes), ideally both ship together in v0.1.12 so the fleet needs a single rollout. Ansible-side interim mitigation: appsignal/appsignal-ansible#811.

[backlog-helper]

✔️ All good!

New issue guide | Backlog management | Rules | Feedback