ekklesiaandClaude Opus 5.5
cbf2a8ee39
The platform's rule (its ci-sweep.sh, docs/development/security.md), applied to the one Signage job that starts Docker stacks: - it has its own EKKLESIA_CI_JOB_KEY; - it sweeps stale CI stacks from the runner before it starts; - it removes its own stacks in a final `if: always()` step, which tolerates a failed assembly, since nothing was started then; - the image ci/integration.sh builds is named and labeled as a CI stack of this run and job, with the time CI built it, so the sweep finds it. ci/platform.env moves to the platform commit that adds the sweep (Ekklesia #60). The assembled lockfile is unchanged, and still passes a frozen install. Verified: SIGKILL of the integration script's whole process group mid-run left 11 resources (2 containers, 4 networks, 4 volumes and the image). `ci-sweep.sh --job` removed exactly those 11. A normal run passes, and the job sweep after it finds nothing. Co-Authored-By: Claude Opus 5.5 <[email protected]>