fix: resolve 10 bugs across scripts

- manage_runner.sh: fix RUNNER_DEFAULT_IMAGE clobbering by renaming
  per-runner var to RUNNER_SECTION_IMAGE; .env fallback now works
- manage_runner.sh: render native runner config.yaml before registration
  so act_runner can read it during --config flag
- manage_runner.sh: add SSH credential validation for remote hosts
  (fail early with clear error instead of cryptic SSH failure)
- phase1/phase2: add UNRAID_DB_IP/FEDORA_DB_IP to conditional
  require_vars when DB_TYPE != sqlite3
- cleanup.sh: only clear manifest when all actions for host succeeded;
  failed actions are preserved for retry
- phase8_cutover.sh: strip empty environment: block from Caddy
  docker-compose when TLS_MODE=existing
- phase5_migrate_pipelines.sh, phase5_teardown.sh, phase9_teardown.sh:
  wrap cd+git in subshells so working directory is always restored
- phase3_post_check.sh: handle both string and numeric runner status
  from Gitea API (offline vs 2)
- configure_env.sh: fix TOTAL_PROMPTS base count (63->64) and move
  DB/repo count adjustments before their prompts are shown

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phase8_cutover.sh

@@ -188,6 +188,16 @@ else
 
   render_template "${SCRIPT_DIR}/templates/docker-compose-caddy.yml.tpl" "$TMPFILE" \
     "\${CADDY_DATA_PATH} \${CADDY_CONTAINER_IP} \${CADDY_ENV_VARS} \${CADDY_EXTRA_VOLUMES}"
+  # Strip empty YAML blocks left when optional vars are blank
+  if [[ -z "$CADDY_ENV_VARS" ]]; then
+    sed -i.bak '/^[[:space:]]*environment:$/d' "$TMPFILE"
+    rm -f "${TMPFILE}.bak"
+  fi
+  if [[ -z "$CADDY_EXTRA_VOLUMES" ]]; then
+    # Remove trailing blank lines after the volumes block
+    sed -i.bak -e :a -e '/^\n*$/{$d;N;ba' -e '}' "$TMPFILE"
+    rm -f "${TMPFILE}.bak"
+  fi
   scp_to UNRAID "$TMPFILE" "${CADDY_DATA_PATH}/docker-compose.yml"
   rm -f "$TMPFILE"
   log_success "Caddy docker-compose.yml deployed"