fix: complete worker host preflight

[Nickfost]

Summary

• finish the repository-owned host preflight required by Add an idempotent Bash installer for CI fleet hosts #21
• fail before configuration or mutation unless the host is supported Debian, required generic tools and CA trust exist, the Docker socket is directly accessible, and Docker storage remains below the existing 80% warning threshold
• keep rollback and uninstall available when install-time host prerequisites disappear
• document the exact supported boundary and add focused OS/disk/recovery regressions

Validation

• scripts/test-install-worker-controller.sh (INSTALLER_TESTS_OK)
• shellcheck scripts/install-worker-controller.sh scripts/test-install-worker-controller.sh
• Bash syntax and git diff --check
• exact-commit committed-secret scan
• capacity-preflight, desired-state, and quickstart tests

External acceptance

Fresh disposable Debian Docker-host acceptance passed at the exact PR head: full repository validation, first install, idempotent convergence, failure/rollback paths, uninstall, real image build, runner-tool smoke, and residue cleanup all completed successfully. GitHub App/runner-group bootstrap remains separately tracked by #27.

[Nickfost]

@codex review

Focused exact-head review at 349821e. Verify the #21 host-preflight completion, especially fail-before-mutation behavior, Debian/version parsing, Docker socket/storage checks, and preserving rollback/uninstall when install prerequisites disappear. Apply the objective review-value gate; reject speculative expansion beyond the documented Debian host contract.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 349821e3cc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Nickfost]

@codex review

Focused exact-head confirmation at 89d7301. Verify both accepted root-cause fixes: rollback/uninstall remain available without install-only dependencies, and every Docker lifecycle call is confined to the verified local Unix socket. Apply the objective review-value gate and collapse duplicates/speculative variants.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 89d7301100

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Nickfost]

Completion-run acceptance passed on a fresh disposable Debian Docker VM at exact head 89d73011005d674db89cd4944e6dd4d55e6dbe7e.

• scripts/validate.sh: exit 0
• installer acceptance: INSTALLER_TESTS_OK
• fresh install, idempotent rerun, drift/failure rollback, explicit rollback, adoption, disabled/drained convergence, and uninstall paths all passed
• real Docker image build and runner tool smoke passed
• final cleanup verified zero containers, images, volumes, custom networks, ci-fleet paths, units, checkout, and bundle

The first validation attempt correctly stopped because the prepared host lacked required jq; after installing the documented prerequisite (and ShellCheck for repository validation), the unchanged exact head passed.