test: manage runners at every scope, rerun and delete a completed run, fail when the runner is required

tests/integration/harness.py

@@ -561,9 +561,19 @@ def stop_gitea(instance: GiteaInstance) -> None:
         cleanup_resources(res)
 
 
-def start_runner(instance: GiteaInstance, registration_token: str) -> str:
+def start_runner(
+    instance: GiteaInstance,
+    registration_token: str,
+    *,
+    suffix: str = "runner",
+    label: str = RUNNER_LABEL,
+) -> str:
     """Start an ``act_runner`` container registered with ``registration_token``.
 
+    ``suffix`` names the container (``aegis-it-<run id>-<suffix>``, also the runner's name in
+    Gitea) and ``label`` is the single label it serves, so extra runners at other scopes
+    never pick up the jobs of the Actions scenario.
+
     The runner joins the run's private network, reaches Gitea by its container name
     (so it works in local and in container network mode) and runs jobs labelled
     ``aegis-host`` in host mode inside its own container. The token travels in the
@@ -575,7 +585,7 @@ def start_runner(instance: GiteaInstance, registration_token: str) -> str:
     if res is None:
         raise HarnessError("the Gitea instance is not tracked (already stopped?)")
     ensure_image(ACT_RUNNER_IMAGE)
-    name = f"{NAME_PREFIX}{instance.run_id}-runner"
+    name = f"{NAME_PREFIX}{instance.run_id}-{suffix}"
     res.extra_containers.append(name)
     run_docker(
         "run",
@@ -593,7 +603,7 @@ def start_runner(instance: GiteaInstance, registration_token: str) -> str:
         "-e",
         f"GITEA_RUNNER_NAME={name}",
         "-e",
-        f"GITEA_RUNNER_LABELS={RUNNER_LABEL}:host",
+        f"GITEA_RUNNER_LABELS={label}:host",
         ACT_RUNNER_IMAGE,
         env={RUNNER_REGISTRATION_ENV: registration_token},
         timeout=300,