ci: stop the whole pipeline on the first failure and report why the restore image is missing [CI]

Every Linux step now runs under ci/guard-step.py. The first step that fails, is cancelled or times out marks the pipeline; running steps get SIGTERM (so traps release flock and Buildah state) then SIGKILL, steps that have not started exit at once, and any process a step leaves behind is killed. A pipeline deadline is the last resort. build-linux-agent.sh now prints the lookup error, store configuration and the restore images present when the prepared restore image cannot be found.

.woodpecker/verify.yml

@@ -18,10 +18,7 @@ steps:
   - name: openwrt-updater-tests
     image: bash
     commands:
-      - sh -n packaging/openwrt/install.sh
-      - bash -n ci/publish-openwrt.sh
-      - python3 scripts/test-linux-agent-build.py
-      - python3 scripts/test-openwrt-updater.py
+      - python3 ci/guard-step.py openwrt-updater-tests 600 bash ci/test-ci-scripts.sh
   - name: backend-tests
     image: bash
     # [SKIP TESTS] omits Backend tests only; web-build remains a dependent workflow.
@@ -31,4 +28,4 @@ steps:
       NUGET_PACKAGES: /home/justme/woodpecker/cache/nuget/packages
     commands:
       # 增量编译 + 快的那批测试（约 20 秒）；慢的端到端测试在 e2e workflow 里和出镜像并行跑。见 ci/verify-backend.sh
-      - bash ci/verify-backend.sh fast
+      - python3 ci/guard-step.py backend-tests 900 bash ci/verify-backend.sh fast