ci: keep build cache cleanup best-effort in the restore step [CI]

The restore step failed after restoring every dependency because the final cache cleanup (buildah unshare reporting memfd_create) was not guarded. Cleanup failures now only warn, and a test requires every cleanup call to be guarded.

scripts/test-linux-agent-build.py

@@ -129,6 +129,16 @@ esac
                         self.assertEqual((base / 'output/moshiro-agent').read_bytes(), b'agent')
                         self.assertEqual((base / 'output/fleet-enroll').read_bytes(), b'enroll')
 
+    def test_cache_cleanup_never_fails_the_step_that_called_it(self):
+        # 清理在调用方持锁之后才做，依赖已经还原或构建好了：它失败（比如 buildah unshare 报 memfd_create）只能是警告。
+        for script in ('ci/restore-linux-dependencies.sh', 'ci/build-linux-agent.sh'):
+            calls = [line for line in (ROOT / script).read_text().splitlines() if 'cleanup-build-cache.sh' in line and not line.lstrip().startswith('#')]
+            self.assertTrue(calls, script)
+            for line in calls:
+                self.assertIn('||', line, f'{script}: {line.strip()}')
+        cleanup = (ROOT / 'ci/cleanup-build-cache.sh').read_text()
+        self.assertIn('if ! buildah unshare python3', cleanup)
+
     def test_linux_packages_preserve_installers_and_shared_library_payloads(self):
         with tempfile.TemporaryDirectory() as directory:
             base = Path(directory)