fix(runtime): stop the reaper sweeping LIVE jobs' dind bind staging dirs

[luthermonson]

Regression introduced by #187 (shipped in v0.2.8, present in every release since including v0.2.12). Actively breaking jobs on the Linux amd64 nodes.

Reported symptom

docker: Error response from daemon: bind mount /home/runner/_work/ephpm/ephpm -> /w rejected:
  creating bind staging mountpoint /var/lib/ephemerd/dind-binds/ephemerd-github-ephpm-sure_hopper/2:
  mkdir /var/lib/ephemerd/dind-binds/... : no such file or directory
##[error]Process completed with exit code 127

Cause

#187's periodic dead-container reaper calls the whole-tree dind.SweepStagedBinds once per pass (pkg/runtime/runtime.go). That function is documented STARTUP ONLY, and its own comment states the failure mode precisely:

"it does not know which jobs are live, and unmounting a running job's staged bind would not break that job's already-running containers but would break any container it starts next."

Sequence:

1. A job is running with staged binds under <data>/dind-binds/<jobID>/
2. The reaper tick finds some unrelated dead container to reap
3. It sweeps the entire dind-binds tree first — deleting live jobs' directories too
4. The live job's already-running containers are unaffected (their mounts are in their namespaces), so nothing fails loudly
5. Its next docker run -v cannot create its mountpoint: ensureDirLocked has latched m.ready and will not recreate the parent, and os.Mkdir is non-recursive → ENOENT

The index /2 in the error is the tell: binds 0 and 1 staged fine, then a tick landed.

Why ephpm surfaced it: its release workflow runs several docker run -v "$PWD":/w steps per job (since the node24 de-containerization), so it has the most exposure.

Fix

Sweep only the staging dir of the container actually being reaped, via a new SweepStagedBindsForJob. The reaping motive is unchanged — a leaked staged mount pins that container's rootfs so WithSnapshotCleanup fails with "device or resource busy" — and scoping it preserves that without touching anyone else's directory.

The startup-only whole-tree sweep in CleanOrphans is left exactly as-is; that one is correct, because nothing is live at startup.

Tests

TestSweepStagedBindsForJob_SparesOtherJobs creates a dead and a live job staging dir, sweeps the dead one, and asserts the live one survives with its mountpoint subdirectory intact — the precise property that was violated. Plus a tolerates-missing case (a job with no -v anywhere, and empty-arg guards). Deliberately mount-free so it runs in CI without privileges.

Verification

GOOS=linux go vet ./pkg/dind/... ./pkg/runtime/... clean; go test ./pkg/dind/... ./pkg/runtime/... green on the dev box.

Caveat: the dev box is Windows, so the new Linux tests were compile-verified (GOOS=linux go vet) but not executed locally — CI's "Lint, Unit, E2E & Build (Linux)" is the gate. The existing bind-staging tests need real mount privileges and can only run there.

[ephpm]

ePHPm Preview — removed

Preview deployment has been torn down.