fix: resolve 10 bugs across scripts

- manage_runner.sh: fix RUNNER_DEFAULT_IMAGE clobbering by renaming
  per-runner var to RUNNER_SECTION_IMAGE; .env fallback now works
- manage_runner.sh: render native runner config.yaml before registration
  so act_runner can read it during --config flag
- manage_runner.sh: add SSH credential validation for remote hosts
  (fail early with clear error instead of cryptic SSH failure)
- phase1/phase2: add UNRAID_DB_IP/FEDORA_DB_IP to conditional
  require_vars when DB_TYPE != sqlite3
- cleanup.sh: only clear manifest when all actions for host succeeded;
  failed actions are preserved for retry
- phase8_cutover.sh: strip empty environment: block from Caddy
  docker-compose when TLS_MODE=existing
- phase5_migrate_pipelines.sh, phase5_teardown.sh, phase9_teardown.sh:
  wrap cd+git in subshells so working directory is always restored
- phase3_post_check.sh: handle both string and numeric runner status
  from Gitea API (offline vs 2)
- configure_env.sh: fix TOTAL_PROMPTS base count (63->64) and move
  DB/repo count adjustments before their prompts are shown

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

manage_runner.sh

@@ -40,7 +40,7 @@ EOF
 # ---------------------------------------------------------------------------
 # Parse a runner entry from runners.conf (INI format) by section name.
 # Sets globals: RUNNER_NAME, RUNNER_HOST, RUNNER_TYPE, RUNNER_DATA_PATH,
-#   RUNNER_LABELS, RUNNER_DEFAULT_IMAGE, RUNNER_REPOS, RUNNER_CAPACITY,
+#   RUNNER_LABELS, RUNNER_SECTION_IMAGE, RUNNER_REPOS, RUNNER_CAPACITY,
 #   RUNNER_CPU, RUNNER_MEMORY, RUNNER_BOOT
 # Also resolves: RUNNER_SSH_HOST, RUNNER_SSH_USER, RUNNER_SSH_PORT,
 #   RUNNER_SSH_KEY (from .env or custom section keys)
@@ -65,7 +65,7 @@ parse_runner_entry() {
   RUNNER_TYPE=$(ini_get "$RUNNERS_CONF" "$target_name" "type" "")
   RUNNER_DATA_PATH=$(ini_get "$RUNNERS_CONF" "$target_name" "data_path" "")
   RUNNER_LABELS=$(ini_get "$RUNNERS_CONF" "$target_name" "labels" "")
-  RUNNER_DEFAULT_IMAGE=$(ini_get "$RUNNERS_CONF" "$target_name" "default_image" "")
+  RUNNER_SECTION_IMAGE=$(ini_get "$RUNNERS_CONF" "$target_name" "default_image" "")
   RUNNER_REPOS=$(ini_get "$RUNNERS_CONF" "$target_name" "repos" "all")
   RUNNER_CAPACITY=$(ini_get "$RUNNERS_CONF" "$target_name" "capacity" "1")
   RUNNER_CPU=$(ini_get "$RUNNERS_CONF" "$target_name" "cpu" "")
@@ -107,6 +107,18 @@ parse_runner_entry() {
       ;;
   esac
 
+  # --- Validate SSH credentials for remote hosts ---
+  if [[ "$RUNNER_SSH_HOST" != "local" ]]; then
+    if [[ -z "$RUNNER_SSH_HOST" ]]; then
+      log_error "Runner '$target_name': SSH host is empty (check .env for ${RUNNER_HOST^^}_IP)"
+      return 1
+    fi
+    if [[ -z "$RUNNER_SSH_USER" ]]; then
+      log_error "Runner '$target_name': SSH user is empty (check .env for ${RUNNER_HOST^^}_SSH_USER)"
+      return 1
+    fi
+  fi
+
   # --- Validate required fields ---
   if [[ -z "$RUNNER_TYPE" ]]; then
     log_error "Runner '$target_name': type is empty (must be docker or native)"
@@ -137,9 +149,10 @@ parse_runner_entry() {
 # Sets RUNNER_RESOLVED_IMAGE.
 # ---------------------------------------------------------------------------
 resolve_runner_image() {
-  local image="${RUNNER_DEFAULT_IMAGE:-}"
+  # Per-runner image from runners.conf takes priority, then .env global, then hardcoded fallback
+  local image="${RUNNER_SECTION_IMAGE:-${RUNNER_DEFAULT_IMAGE:-}}"
   if [[ -z "$image" ]] && [[ "$RUNNER_TYPE" == "docker" ]]; then
-    image="${RUNNER_DEFAULT_IMAGE:-catthehacker/ubuntu:act-latest}"
+    image="catthehacker/ubuntu:act-latest"
   fi
 
   if [[ -n "$image" ]] && [[ -n "${LOCAL_REGISTRY:-}" ]]; then
@@ -384,6 +397,16 @@ add_native_runner() {
     log_success "act_runner binary downloaded"
   fi
 
+  # Render runner config (must exist before registration — act_runner reads it)
+  local tmpfile
+  tmpfile=$(mktemp)
+  # shellcheck disable=SC2090  # intentional — RUNNER_LABELS_YAML rendered via envsubst
+  export RUNNER_NAME RUNNER_DATA_PATH RUNNER_LABELS_YAML RUNNER_CAPACITY
+  render_template "${SCRIPT_DIR}/templates/runner-config.yaml.tpl" "$tmpfile" \
+    "\${RUNNER_NAME} \${RUNNER_LABELS_YAML} \${RUNNER_CAPACITY}"
+  cp "$tmpfile" "${RUNNER_DATA_PATH}/config.yaml"
+  rm -f "$tmpfile"
+
   # Register the runner with Gitea
   if [[ ! -f "${RUNNER_DATA_PATH}/.runner" ]]; then
     log_info "Registering runner with Gitea..."
@@ -397,16 +420,6 @@ add_native_runner() {
     log_success "Runner registered"
   fi
 
-  # Render runner config
-  local tmpfile
-  tmpfile=$(mktemp)
-  # shellcheck disable=SC2090  # intentional — RUNNER_LABELS_YAML rendered via envsubst
-  export RUNNER_NAME RUNNER_DATA_PATH RUNNER_LABELS_YAML RUNNER_CAPACITY
-  render_template "${SCRIPT_DIR}/templates/runner-config.yaml.tpl" "$tmpfile" \
-    "\${RUNNER_NAME} \${RUNNER_LABELS_YAML} \${RUNNER_CAPACITY}"
-  cp "$tmpfile" "${RUNNER_DATA_PATH}/config.yaml"
-  rm -f "$tmpfile"
-
   # Render launchd plist.
   # When boot=true, insert a <key>UserName</key> entry so the daemon runs as
   # the deploying user instead of root (LaunchDaemons default to root).