Merge pull request 'ci: run the image job on mac2, and make the staging gate say what failed' (#253) from ci/image-on-mac2 into main

Three jobs green on 15737e05, the image job among them: pinned to mac2, it built the candidate and passed the staging gate that had failed twice on mac1.

.gitea/workflows/ci.yml

@@ -93,7 +93,14 @@ jobs:
 
   image:
     needs: [checks, swift]
-    runs-on: ubuntu-latest
+    # mac2, by name. The staging gate starts a throwaway Postgres, a Redis and
+    # the candidate relay as sibling containers on the host daemon. On mac1 the
+    # Postgres never reached `pg_isready` inside the gate's 90 s window (runs
+    # 441 and 434 differ in nothing but the runner: mac2 passed, mac1 failed on
+    # the same two commits), and mac1 has the smaller OrbStack allocation.
+    # Named here rather than left to whichever runner is free, so the result
+    # does not depend on which machine picks the job up.
+    runs-on: [ubuntu-latest, mac2]
     steps:
       - uses: actions/checkout@v4
       # The Dockerfile uses RUN --mount (BuildKit). The static docker tarball

Scripts/ci-staging-gate.sh

@@ -42,7 +42,18 @@ for i in $(seq 1 45); do
   docker exec "${STACK}-db" pg_isready -U staging >/dev/null 2>&1 && break
   sleep 2
 done
-docker exec "${STACK}-db" pg_isready -U staging >/dev/null 2>&1 || fail "staging postgres never became ready"
+if ! docker exec "${STACK}-db" pg_isready -U staging >/dev/null 2>&1; then
+  # Say WHICH of the two it was. "never became ready" covered both a Postgres
+  # that was still starting and a container that never ran at all, and the two
+  # need different fixes. mac1 failed here with no further word, which is how
+  # 90 s of waiting read as a relay bug.
+  echo "--- staging postgres state ---"
+  docker inspect -f 'state={{.State.Status}} exit={{.State.ExitCode}} error={{.State.Error}}' \
+    "${STACK}-db" 2>&1 || echo "the container does not exist"
+  echo "--- staging postgres log ---"
+  docker logs --tail 40 "${STACK}-db" 2>&1 || true
+  fail "staging postgres never became ready"
+fi
 
 # Throwaway issuer keypair, minted per run and never stored.
 PRIV_PEM=$(openssl genpkey -algorithm ed25519 2>/dev/null)