runner: drain in-flight jobs on SIGTERM instead of dying

[rcurranmoz]

Why

launchd sends SIGTERM to the runner on every restart: the step-ca cert renewal (step ca renew --daemon --exec launchctl kickstart -k …), a puppet reload's bootout, and a manual reload. The runner died immediately, and any in-flight job's reprovision subprocess died with it. Mid-EACS, that strands the host quarantined and leaves its Hangar job open forever.

What

• On SIGTERM the runner stops claiming, finishes its in-flight jobs, and then exits. launchd's KeepAlive restarts it onto the new cert or code.
• stop is re-checked before every claim, so a SIGTERM that lands mid fill-pass doesn't start new work. One of the new tests caught that gap in the first version.
• The main loop moves into a testable _serve(client, cfg, pool, stop). Behaviour is otherwise unchanged.

Needs the ronin side: launchd only waits ExitTimeOut (default 20s) before SIGKILL. The companion ronin PR raises it for the runner plist. The two are independent and either can merge first: each alone behaves exactly like today.

Verified

• launchd behaviour, on a throwaway LaunchAgent: kickstart -k delivers SIGTERM to the main process only, blocks until it exits (up to ExitTimeOut), and the child keeps running during the drain.
• Real runner, locally: pointed at a dead API URL and sent SIGTERM, it logged "no new claims; draining" and then "drained … exiting", and exited cleanly.
• 3 new tests:
  • no claims after stop, and _serve stays alive until the in-flight job finishes (5/5 repeat runs)
  • idle plus stop returns promptly
  • main() installs the handler
• 285 tests pass with op removed from PATH; ruff is clean.

🤖 Generated with Claude Code