Clean up fidelity sidecars so they never leak on the runner (#69)

The fidelity gate starts pandoc + Gotenberg via `docker run` on the shared
act_runner host but never removed them: a leaked (Chromium-backed) Gotenberg
container wasted memory until the next run and broke re-runs on the container
name. Pre-clean before starting, tear down with `if: always()`, and add a
10-minute job timeout so a hung sidecar can't linger.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1

.gitea/workflows/ci.yml

@@ -346,6 +346,9 @@ jobs:
   fidelity:
     name: Import/export fidelity gate
     runs-on: ubuntu-latest
+    # A guard so a hung sidecar can never keep the job (and its containers)
+    # alive on the shared runner host; the suite itself finishes in ~1 min.
+    timeout-minutes: 10
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -380,6 +383,9 @@ jobs:
       # ports avoid colliding with anything else on the runner.
       - name: Start pinned pandoc + Gotenberg sidecars
         run: |
+          # Clear any leftovers from an earlier interrupted run so the named
+          # containers never collide, and nothing leaks on the shared host.
+          docker rm -f fidelity-pandoc fidelity-gotenberg 2>/dev/null || true
           docker run -d --name fidelity-pandoc -p 13030:3030 pandoc/core:3.6 server
           docker run -d --name fidelity-gotenberg -p 13000:3000 gotenberg/gotenberg:8
           GW=$(ip -4 route show default | awk '{print $3; exit}')
@@ -410,6 +416,13 @@ jobs:
           echo '--- pandoc ---'; docker logs fidelity-pandoc 2>&1 | tail -30 || true
           echo '--- gotenberg ---'; docker logs fidelity-gotenberg 2>&1 | tail -30 || true
 
+      # Always tear the sidecars down — they run on the shared runner host, so a
+      # leaked (especially Chromium-backed Gotenberg) container would waste its
+      # memory until the next run and break re-runs on the container name.
+      - name: Stop sidecars
+        if: always()
+        run: docker rm -f fidelity-pandoc fidelity-gotenberg 2>/dev/null || true
+
   images:
     name: Build container images
     # PR-only: on main the CD workflow builds and pushes the same images —