ci: run the image job on mac2, and make the staging gate say what failed

The image job failed on PR #252 and passed on main with no code difference
between them that touches CI. The runner is the difference: run 434 built on
mac2 and passed, run 441 built on mac1 and failed at "staging postgres never
became ready", on the same two commits. mac1 has the smaller OrbStack
allocation, and the gate starts three sibling containers on the host daemon.
The job now names mac2 rather than taking whichever runner is free.

The gate also prints the container's state and log when Postgres does not come
up. "Never became ready" covered both a Postgres still starting and a
container that never ran, which need different fixes, and mac1 said nothing
further, so 90 seconds of waiting read as a relay bug.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -93,7 +93,14 @@ jobs:
 
   image:
     needs: [checks, swift]
-    runs-on: ubuntu-latest
+    # mac2, by name. The staging gate starts a throwaway Postgres, a Redis and
+    # the candidate relay as sibling containers on the host daemon. On mac1 the
+    # Postgres never reached `pg_isready` inside the gate's 90 s window (runs
+    # 441 and 434 differ in nothing but the runner: mac2 passed, mac1 failed on
+    # the same two commits), and mac1 has the smaller OrbStack allocation.
+    # Named here rather than left to whichever runner is free, so the result
+    # does not depend on which machine picks the job up.
+    runs-on: [ubuntu-latest, mac2]
     steps:
       - uses: actions/checkout@v4
       # The Dockerfile uses RUN --mount (BuildKit). The static docker tarball

Scripts/ci-staging-gate.sh

@@ -42,7 +42,18 @@ for i in $(seq 1 45); do
   docker exec "${STACK}-db" pg_isready -U staging >/dev/null 2>&1 && break
   sleep 2
 done
-docker exec "${STACK}-db" pg_isready -U staging >/dev/null 2>&1 || fail "staging postgres never became ready"
+if ! docker exec "${STACK}-db" pg_isready -U staging >/dev/null 2>&1; then
+  # Say WHICH of the two it was. "never became ready" covered both a Postgres
+  # that was still starting and a container that never ran at all, and the two
+  # need different fixes. mac1 failed here with no further word, which is how
+  # 90 s of waiting read as a relay bug.
+  echo "--- staging postgres state ---"
+  docker inspect -f 'state={{.State.Status}} exit={{.State.ExitCode}} error={{.State.Error}}' \
+    "${STACK}-db" 2>&1 || echo "the container does not exist"
+  echo "--- staging postgres log ---"
+  docker logs --tail 40 "${STACK}-db" 2>&1 || true
+  fail "staging postgres never became ready"
+fi
 
 # Throwaway issuer keypair, minted per run and never stored.
 PRIV_PEM=$(openssl genpkey -algorithm ed25519 2>/dev/null)