feat(runner): tgit-runner — сервисы в песочнице на хосте, деплой после push (#13)

- infra/runner/tgit-runner: deploy/restart/remove/list по SSH forced command;
  аргументы не исполняются и не глобятся; архив — только файлы и папки,
  без «..», ≤ 20 МБ, есть main.py; health_url — только localhost
- песочница: uid 10001, read-only, tmpfs noexec, cap-drop ALL,
  no-new-privileges, 128 МБ без swap, 0.25 CPU, 64 PID, --network none
  (сеть — только по egress-allow админа), лимит 10 сервисов, 2 образа
- новая версия стартует рядом (-next) и заменяет старую, только став
  healthy; иначе удаляется, старая работает, exit 3
- бот: после push git archive изменённых services/<name>/ → runner;
  автору — «🚀 работает» или «⛔ не развёрнут» с логом, команде — алерт ⛔;
  удалённая папка → remove; «♻️ Перезапустить» в «Статусе» для админа (S-5)
- examples/escape_attempts: все попытки выбраться — BLOCKED на живом Docker
- install.sh, authorized_keys.example; CD бота обновляет runner на хосте

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/bot/routers/status.py

@@ -13,7 +13,8 @@ from aiogram.utils.keyboard import InlineKeyboardBuilder
 
 from app.bot.menu import Nav, NavAction
 from app.bot.routers.commit import human_size
-from app.db.models import utcnow
+from app.db.models import Role, User, utcnow
+from app.runner.client import RunnerClient
 from app.runtime.checks import Checker, CheckName, ContainerReport
 from app.runtime.docker import Container, Details, DockerClient, DockerError, Stats
 from app.texts import StatusTexts, Texts
@@ -27,6 +28,7 @@ class StatusAct(StrEnum):
     LIST = "l"
     CARD = "c"
     CHECK = "k"
+    RESTART = "r"
 
 
 class StatusCb(CallbackData, prefix="s"):
@@ -75,7 +77,10 @@ def render_list(texts: Texts, containers: list[Container], now: datetime) -> tup
     return _clip("\n".join(lines)), kb.as_markup()
 
 
-def render_card(texts: Texts, d: Details, stats: Stats | None, now: datetime) -> tuple[str, InlineKeyboardMarkup]:
+def render_card(
+    texts: Texts, d: Details, stats: Stats | None, now: datetime, can_restart: bool = False
+) -> tuple[str, InlineKeyboardMarkup]:
+    """can_restart: an admin looking at a service deployed by tgit-runner (S-5)."""
     t = texts.status
     running = d.state == "running"
     uptime = duration(t, (now - d.started_at).total_seconds()) if running and d.started_at else t.none
@@ -105,11 +110,18 @@ def render_card(texts: Texts, d: Details, stats: Stats | None, now: datetime) ->
     kb = InlineKeyboardBuilder()
     kb.button(text=t.check_button, callback_data=StatusCb(a=StatusAct.CHECK, id=d.id[:12]))
     kb.button(text=t.refresh, callback_data=StatusCb(a=StatusAct.CARD, id=d.id[:12]))
+    if can_restart and runner_service(d):
+        kb.button(text=t.restart, callback_data=StatusCb(a=StatusAct.RESTART, id=d.id[:12]))
     kb.button(text=t.to_list, callback_data=StatusCb(a=StatusAct.LIST))
-    kb.adjust(2, 1)
+    kb.adjust(2, 1, 1)
     return text, kb.as_markup()
 
 
+def runner_service(d: Details) -> str | None:
+    """Only services tgit-runner deployed can be restarted through it — not the bot, its DB or the proxy."""
+    return d.labels.get("tgit.service") or None
+
+
 def render_report(
     texts: Texts, reports: list[ContainerReport], now: datetime, back_id: str = ""
 ) -> tuple[str, InlineKeyboardMarkup]:
@@ -141,7 +153,9 @@ def render_report(
     return _clip("\n".join(lines)), kb.as_markup()
 
 
-def build_router(texts: Texts, docker: DockerClient | None, checker: Checker | None) -> Router:
+def build_router(
+    texts: Texts, docker: DockerClient | None, checker: Checker | None, runner: RunnerClient | None = None
+) -> Router:
     router = Router(name="status")
     t = texts.status
 
@@ -150,7 +164,7 @@ def build_router(texts: Texts, docker: DockerClient | None, checker: Checker | N
             raise DockerError("docker is not configured (DOCKER_URL)")
         return render_list(texts, await docker.containers(), utcnow())
 
-    async def card_screen(short_id: str) -> tuple[str, InlineKeyboardMarkup]:
+    async def card_screen(short_id: str, is_admin: bool = False) -> tuple[str, InlineKeyboardMarkup]:
         if docker is None:
             raise DockerError("docker is not configured (DOCKER_URL)")
         cid = await docker.resolve(short_id)
@@ -161,7 +175,7 @@ def build_router(texts: Texts, docker: DockerClient | None, checker: Checker | N
                 stats = await docker.stats(cid)
             except DockerError:
                 log.warning("stats %s unavailable", short_id)
-        return render_card(texts, details, stats, utcnow())
+        return render_card(texts, details, stats, utcnow(), can_restart=is_admin and runner is not None)
 
     @router.message(F.text == texts.menu.status)
     async def open_status(message: Message, state: FSMContext) -> None:
@@ -175,7 +189,7 @@ def build_router(texts: Texts, docker: DockerClient | None, checker: Checker | N
         await message.answer(text, reply_markup=kb)
 
     @router.callback_query(StatusCb.filter())
-    async def on_action(query: CallbackQuery, callback_data: StatusCb) -> None:
+    async def on_action(query: CallbackQuery, callback_data: StatusCb, member: User) -> None:
         if not isinstance(query.message, Message):
             await query.answer()
             return
@@ -185,7 +199,23 @@ def build_router(texts: Texts, docker: DockerClient | None, checker: Checker | N
                 case StatusAct.LIST:
                     text, kb = await list_screen()
                 case StatusAct.CARD:
-                    text, kb = await card_screen(callback_data.id)
+                    text, kb = await card_screen(callback_data.id, member.role is Role.ADMIN)
+                case StatusAct.RESTART:
+                    if docker is None or runner is None or member.role is not Role.ADMIN:
+                        await query.answer()
+                        return
+                    service = runner_service(await docker.inspect(await docker.resolve(callback_data.id)))
+                    if service is None:
+                        await query.answer()
+                        return
+                    result = await runner.restart(service)
+                    if not result.ok:
+                        await query.answer(t.restart_failed.format(reason=result.summary)[:200], show_alert=True)
+                        return
+                    await query.answer(t.restarted)
+                    text, kb = await card_screen(callback_data.id, True)
+                    await _edit(msg, text, kb)
+                    return
                 case StatusAct.CHECK:
                     if docker is None or checker is None:
                         raise DockerError("docker is not configured (DOCKER_URL)")