Stop GPG agent before removing signature-verification home

[Copilot]

Description:
On self-hosted runners with NFS-backed RUNNER_TEMP, signature verification can succeed but the step can fail while removing an agent-held .nfs* file.

• Cleanup: Stop the verification GPG agent before removing its temporary home, reusing the existing best-effort shutdown behavior.
• Coverage: Add tests for cleanup after successful and failed verification, including when gpgconf is unavailable.

Related issue:
NFS-backed RUNNER_TEMP signature-verification cleanup failure.

Download URL:
Not applicable; no new distribution.

License:
Not applicable; no new distribution.

Check list:

• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.
• Mark if new distribution is being added.

• Fixes verify-signature cleanup fails with EBUSY when RUNNER_TEMP is on NFS (self-hosted, v6.0.0) #1272

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation, generated bundles, and tests consistently address the reported NFS cleanup failure.

Review effort: Balanced
Findings: None

What changed in this PR

Stops temporary GPG agents before deleting signature-verification homes, preventing NFS cleanup failures.

Changes:

• Extracts reusable best-effort GPG agent shutdown.
• Applies shutdown to verification cleanup.
• Adds success, failure, and unavailable-gpgconf coverage.

File	Description
src/​gpg.ts	Stops agents before home removal.
__tests__/​gpg.test.ts	Covers all cleanup outcomes.
dist/​setup/​81.index.js	Updates generated setup bundle.
dist/​setup/​220.index.js	Updates generated setup bundle.
dist/​setup/​463.index.js	Updates generated setup bundle.
dist/​cleanup/​index.js	Updates generated cleanup bundle.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.