ci: keep build cache cleanup best-effort in the restore step [CI]

The restore step failed after restoring every dependency because the final cache cleanup (buildah unshare reporting memfd_create) was not guarded. Cleanup failures now only warn, and a test requires every cleanup call to be guarded.

ci/cleanup-build-cache.sh

@@ -24,4 +24,7 @@ for image in "${expired[@]}"; do
 done
 echo "expired build layers considered: ${#expired[@]} (retention: 7 days; NuGet cache retained)"
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-buildah unshare python3 "$root/ci/cleanup-retired-stores.py" /home/justme/woodpecker/buildah-home
+# 旧的 Buildah 存储目录需要在 buildah unshare 里删（属主是映射后的 uid）；这台主机上 unshare 失败时（memfd_create 之类）只警告，下次再试，不影响调用方。
+if ! buildah unshare python3 "$root/ci/cleanup-retired-stores.py" /home/justme/woodpecker/buildah-home; then
+  echo 'warning: retired Buildah stores were not cleaned (buildah unshare failed); the next run retries' >&2
+fi

ci/restore-linux-dependencies.sh

@@ -149,8 +149,9 @@ PY
   done
   flock -u 9
   agent_lock_held=false
+  # 清理只是尽力而为：依赖已经还原好了，清理失败（比如 buildah unshare 在这台主机上报 memfd_create 错误）不能让这一步失败
   if flock -n -x 9; then
-    bash "$root/ci/cleanup-build-cache.sh"
+    bash "$root/ci/cleanup-build-cache.sh" || echo 'warning: build cache cleanup failed' >&2
     flock -u 9
   fi
 fi

scripts/test-linux-agent-build.py

@@ -129,6 +129,16 @@ esac
                         self.assertEqual((base / 'output/moshiro-agent').read_bytes(), b'agent')
                         self.assertEqual((base / 'output/fleet-enroll').read_bytes(), b'enroll')
 
+    def test_cache_cleanup_never_fails_the_step_that_called_it(self):
+        # 清理在调用方持锁之后才做，依赖已经还原或构建好了：它失败（比如 buildah unshare 报 memfd_create）只能是警告。
+        for script in ('ci/restore-linux-dependencies.sh', 'ci/build-linux-agent.sh'):
+            calls = [line for line in (ROOT / script).read_text().splitlines() if 'cleanup-build-cache.sh' in line and not line.lstrip().startswith('#')]
+            self.assertTrue(calls, script)
+            for line in calls:
+                self.assertIn('||', line, f'{script}: {line.strip()}')
+        cleanup = (ROOT / 'ci/cleanup-build-cache.sh').read_text()
+        self.assertIn('if ! buildah unshare python3', cleanup)
+
     def test_linux_packages_preserve_installers_and_shared_library_payloads(self):
         with tempfile.TemporaryDirectory() as directory:
             base = Path(directory)