ci: keep WSL agent online for pipelines [CI]

ci/start-wsl-runner.ps1

@@ -0,0 +1,20 @@
+param(
+    [string]$Distribution = 'Debian',
+    [string]$LinuxUser = 'justme'
+)
+$ErrorActionPreference = 'Stop'
+# systemd services alone do not keep a WSL distribution running.
+# Run a foreground Linux process in a hidden Windows task at user logon.
+if ($Distribution -notmatch '^[a-zA-Z0-9_.-]+$' -or $LinuxUser -notmatch '^[a-zA-Z0-9_.-]+$') {
+    throw 'Distribution and user names must contain only letters, digits, _, . or -.'
+}
+$userName = [Security.Principal.WindowsIdentity]::GetCurrent().Name
+$taskName = "MoShiro WSL runner ($Distribution)"
+$command = "& '$env:SystemRoot\System32\wsl.exe' --distribution $Distribution --user $LinuxUser --exec /bin/sleep infinity"
+$action = New-ScheduledTaskAction -Execute "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -Argument "-NoProfile -WindowStyle Hidden -Command `"$command`""
+$trigger = New-ScheduledTaskTrigger -AtLogOn -User $userName
+$principal = New-ScheduledTaskPrincipal -UserId $userName -LogonType Interactive -RunLevel Limited
+$settings = New-ScheduledTaskSettingsSet -Hidden -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
+Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Description 'Keep Debian WSL running for the systemd Woodpecker CI agent.' -Force | Out-Null
+Start-ScheduledTask -TaskName $taskName
+Get-ScheduledTask -TaskName $taskName | Select-Object TaskName, State

ci/woodpecker-agent-podman.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=Woodpecker agent in rootless Podman (WSL local backend)
-After=network-online.target
-Wants=network-online.target
+After=network-online.target user@1000.service
+Wants=network-online.target user@1000.service
 
 [Service]
 Type=simple
@@ -10,6 +10,7 @@ Group=justme
 WorkingDirectory=/home/justme/woodpecker
 Environment=HOME=/home/justme
 Environment=XDG_RUNTIME_DIR=/run/user/1000
+Environment=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
 ExecStartPre=-/usr/bin/podman rm --force woodpecker-agent-podman
 ExecStart=/usr/bin/podman run --rm --pull=never --name woodpecker-agent-podman --security-opt=seccomp=unconfined --cap-add=SYS_ADMIN --device=/dev/fuse --network=host --volume=/home/justme:/home/justme:rw,rslave --env-file=/home/justme/woodpecker/agent-podman.env localhost/moshiro-woodpecker-agent:ci
 ExecStop=-/usr/bin/podman stop --time 30 woodpecker-agent-podman

docs/ops/deployment.md

@@ -86,6 +86,8 @@ WSL 的 agent 通过 rootless Podman 运行，systemd 模板见 `ci/woodpecker-a
 
 所有镜像构建、索引及签名清单发布脚本通过 `ci/buildah-env.sh` 显式配置 Buildah 的 `graphroot` 和 `runroot`。镜像层继续按组件/架构存放在各自的 `buildah-home` 下，运行状态留在当前 runner 的临时目录；容器内 UID 0 不再使各步骤落到同一个 `/var/lib/containers/storage`。`RUN` 默认使用 `chroot` isolation，避免额外的 OCI runtime/cgroup 嵌套；这与上面禁止的 agent 启动方式是不同阶段。
 
+WSL 的 systemd 服务不会单独阻止发行版空闲退出。Windows 登录用户运行 `powershell -ExecutionPolicy Bypass -File ci/start-wsl-runner.ps1`，注册并启动隐藏的登录任务，持续运行 Debian 的前台 `sleep infinity`，让 CI server/agent 保持在线。任务使用当前用户的普通权限；需要暂停 WSL 时先停止任务 `MoShiro WSL runner (Debian)`。agent 单元等待 `user@1000.service` 并设置用户 D-Bus 地址，让 rootless Podman 使用已就绪的用户会话。
+
 ### Pull request 与 main 验证
 
 Pull request 和 `main` 的 push 会跑三个 workflow：