GRM-170: fix: harden stall-detection enumeration and timestamp parsing

ansible/roles/gitea_runner/templates/runner-healthcheck.sh.j2

@@ -38,10 +38,15 @@ fi
 STALL_MINUTES={{ gitea_runner_stall_minutes }}
 DIAG_DIR="{{ gitea_runner_config_dir }}"
 now_epoch=$(date +%s)
-timeout 15 docker ps --filter "name=GITEA-ACTIONS-TASK" \
-    --format '{% raw %}{{.ID}} {{.Names}} {{.CreatedAt}}{% endraw %}' 2>/dev/null \
-    | while read -r cid cname ccreated _rest; do
-    created_epoch=$(date -d "$ccreated" +%s 2>/dev/null || echo 0)
+# Implements: REQ-1 — guard the enumeration: a slow/dead daemon must not
+# abort the healthcheck under pipefail; an empty list just skips probing.
+# Implements: REQ-2 — pipe-separate fields: CreatedAt contains spaces, so
+# whitespace-splitting `read` only captured the date and broke the age gate.
+{ timeout 15 docker ps --filter "name=GITEA-ACTIONS-TASK" \
+    --format '{% raw %}{{.ID}}|{{.Names}}|{{.CreatedAt}}{% endraw %}' 2>/dev/null || true; } \
+    | while IFS='|' read -r cid cname ccreated _rest; do
+    # GNU date rejects the redundant " +0000 UTC" suffix — drop it.
+    created_epoch=$(date -d "${ccreated% UTC}" +%s 2>/dev/null || echo 0)
     age_min=$(( (now_epoch - created_epoch) / 60 ))
     [[ "$age_min" -lt "$STALL_MINUTES" ]] && continue
     marker="$DIAG_DIR/.stall-diag-$cid"
@@ -52,7 +57,11 @@ timeout 15 docker ps --filter "name=GITEA-ACTIONS-TASK" \
             echo "=== stall diagnostics for $cname ($cid), age ${age_min}m ==="
             echo "--- exec probe: TIMEOUT (>10s) ---"
             echo "--- docker inspect ---"
-            timeout 15 docker inspect "$cid" 2>/dev/null | head -200
+            # Implements: REQ-3 — full inspect, but redact the Env block:
+            # job containers carry CI tokens in env vars; the bundle must
+            # not become a secret-material artifact.
+            timeout 15 docker inspect "$cid" 2>/dev/null \
+                | sed -E 's/("[^"]*(TOKEN|PASSWORD|SECRET|KEY)[^=]*=)[^",]*/\1<redacted>/Ig'
             echo "--- docker top ---"
             timeout 15 docker top "$cid" 2>/dev/null
             echo "--- docker stats --no-stream ---"