fix(lifecycle): reject failed image loads and drain gateway work

[morluto]

Closes #84

Propagate every VM image-load worker/pipeline failure, verify full image references with docker image inspect, and clean staging files on every exit. Cancel and await gateway trigger tasks before MCP clients close.

Reproduced failure	Before	After
Failed image load, old tag already present	Startup reports success	Failure propagates
Archive left by failed load	64 MiB	0 bytes
Trigger actions pending after shutdown	1	0

Measurements use the production loader shell with local command stubs and the real trigger engine. Tests cover successful parallel loads, Docker/gunzip failures, exact tag verification, partial downloads, and repeated shutdown.

Validation: 6,326 unit/protocol tests passed, 13 existing capability skips; plugin API check passed. Independent correctness and maintainability reviews are clean. Docker/cloud integration remains for CI.

Confidence Score: 5/5

The PR appears safe to merge based on the changes reviewed.

What we checked:

• Cleanup does not hide load errors: _remove_vm_temp_file catches ordinary cleanup errors, so the original load or download error still reaches the caller.

Summary

VM image loading now propagates worker failures, checks the exact requested image references, and cleans up transfer files. Gateway shutdown cancels and awaits trigger work before MCP clients close.

• VM image loads report worker failures and check exact image names.
• Gateway shutdown waits for trigger work before MCP clients close.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Stage image archives] --> B[Start load workers]
  B --> C[Wait for every worker]
  C --> D[Remove staging files]
  D --> E{Every worker succeeded?}
  E -->|Yes| F[Inspect full image references]
  E -->|No| G[Report load failure]

Loading

_{Reviews (2) · Last reviewed commit: "fix(sandbox): retry image loads and clea..." · Reviewed by Greptile}