ci: stop the whole pipeline on the first failure and report why the restore image is missing [CI]

Every Linux step now runs under ci/guard-step.py. The first step that fails, is cancelled or times out marks the pipeline; running steps get SIGTERM (so traps release flock and Buildah state) then SIGKILL, steps that have not started exit at once, and any process a step leaves behind is killed. A pipeline deadline is the last resort. build-linux-agent.sh now prints the lookup error, store configuration and the restore images present when the prepared restore image cannot be found.

ci/build-linux-agent.sh

@@ -36,9 +36,14 @@ cleanup() {
 trap cleanup EXIT
 context="$work/context"
 restore_image="localhost/moshiro-agent-restore:${CI_COMMIT_SHA}-${rid}"
-restore_id="$(buildah images --noheading --no-trunc --format '{{.ID}}' "$restore_image" 2>/dev/null || true)"
+restore_error="$work/restore-lookup.err"
+restore_id="$(buildah images --noheading --no-trunc --format '{{.ID}}' "$restore_image" 2>"$restore_error" || true)"
 [[ "${restore_id#sha256:}" =~ ^[0-9a-f]{64}$ ]] || {
   echo "missing prepared restore image $restore_image; run restore-linux-dependencies.sh first" >&2
+  # 找不到的时候把现场打出来：查询的报错、存储配置，以及存储里现有的还原镜像，才分得清是没做出来、被清掉了，还是看的不是同一个存储
+  echo "lookup error: $(tr '\n' ' ' < "$restore_error")" >&2
+  echo "store: ${CONTAINERS_STORAGE_CONF:-unset}, uid $(id -u), isolation ${BUILDAH_ISOLATION:-unset}" >&2
+  { buildah images --all --format '{{.ID}} {{.CreatedAtRaw}} {{.Name}}:{{.Tag}}' 2>&1 | grep -E 'moshiro-agent-restore|error|Error' | head -20 >&2; } || true
   exit 1
 }