runner: drain on SIGTERM !322

Third of three for #179, and the one that makes a deploy safe by construction.

serve runs the workers; on SIGTERM or SIGINT the runner closes a stop channel. A worker checks it only between builds, so the build in flight runs to completion and is reported (with !320's retries), and nothing further is claimed. An idle worker leaves at once instead of sleeping out a poll. A second signal exits immediately, for an operator who needs the process gone; the build then falls to !321's reaper within two minutes.

The drop-in sets TimeoutStopSec=50min — the 45-minute build limit plus report retries — so systemd waits for the drain rather than killing it. make deploy-runner therefore blocks while a build is running, which is the correct behaviour and what the Admin page now says; the idle check from last night is no longer needed.

TestServeDrainsOnStop starts a build, closes stop while it is in flight, and asserts it completes and nothing further is claimed. TestServeStopsWhileIdle asserts an idle worker does not sit out a poll.

Stacked on !321.

Closes #179