fix(ci): harden Molecule download and cleanup

- Retry transient k3s release downloads with bounded backoff.\n- Bound failure diagnostics and validate guest release connectivity.\n- Discover repository-owned Molecule state under the actual project root.

.github/scripts/cleanup-runner-resources.sh

@@ -22,6 +22,7 @@ esac
 
 home_dir="${HOME:?HOME must be set}"
 molecule_root="${K3S_CI_MOLECULE_ROOT:-${home_dir}/.cache/molecule}"
+repository_name="${K3S_CI_MOLECULE_PROJECT:-k3s-ansible}"
 virtualbox_root="${K3S_CI_VIRTUALBOX_ROOT:-${home_dir}/VirtualBox VMs}"
 hostonly_marker="${K3S_CI_HOSTONLY_MARKER:-${home_dir}/.cache/k3s-ci/hostonly-interfaces}"
 
@@ -106,6 +107,10 @@ fail_closed() {
   exit 3
 }
 
+if [[ ! "$repository_name" =~ ^[A-Za-z0-9._-]+$ ]]; then
+  fail_closed 'invalid Molecule repository name'
+fi
+
 print_inventory() {
   local phase="$1"
   printf '%s VirtualBox inventory:\n' "$phase"
@@ -123,14 +128,25 @@ fi
 
 print_inventory before
 
+repository_root_real="$(resolve_existing_dir "$molecule_root_real/$repository_name" || true)"
+if [[ -z "$repository_root_real" ]]; then
+  printf 'No repository Molecule state root exists: %s\n' "$molecule_root_real/$repository_name"
+  cleanup_hostonly
+  print_inventory after
+  exit 0
+fi
+if ! root_contains "$molecule_root_real" "$repository_root_real"; then
+  fail_closed "repository Molecule state root is outside Molecule root: $repository_root_real"
+fi
+
 declare -a state_files=()
 while IFS= read -r -d '' state_file; do
   state_files+=("$state_file")
-done < <(find "$molecule_root_real/repo" -mindepth 6 -maxdepth 6 -type f \
+done < <(find "$repository_root_real" -mindepth 6 -maxdepth 6 -type f \
   -path '*/.vagrant/machines/*/virtualbox/id' -print0 2>/dev/null)
 
 if ((${#state_files[@]} == 0)); then
-  printf 'No repository-owned Molecule Vagrant state found under %s\n' "$molecule_root_real"
+  printf 'No repository-owned Molecule Vagrant state found under %s\n' "$repository_root_real"
   cleanup_hostonly
   print_inventory after
   exit 0
@@ -146,7 +162,7 @@ for state_file in "${state_files[@]}"; do
   machine_name="${machine_dir##*/}"
   scenario_name="${state_dir##*/}"
 
-  if ! root_contains "$molecule_root_real/repo" "$state_dir"; then
+  if ! root_contains "$repository_root_real" "$state_dir"; then
     fail_closed "state path is outside the repository Molecule root: $state_file_real"
   fi
   if ! is_supported_scenario "$scenario_name"; then

.github/scripts/test-cleanup-runner-resources.sh

@@ -11,10 +11,10 @@ trap 'rm -rf -- "$test_root"' EXIT
 molecule_root="$test_root/molecule"
 virtualbox_root="$test_root/VirtualBox VMs"
 fake_bin="$test_root/bin"
-mkdir -p -- "$molecule_root/repo/single_node/.vagrant/machines/control1/virtualbox" \
+mkdir -p -- "$molecule_root/k3s-ansible/single_node/.vagrant/machines/control1/virtualbox" \
   "$virtualbox_root/control1" "$virtualbox_root/unmarked" "$fake_bin"
 printf '%s\n' '11111111-1111-1111-1111-111111111111' \
-  > "$molecule_root/repo/single_node/.vagrant/machines/control1/virtualbox/id"
+  > "$molecule_root/k3s-ansible/single_node/.vagrant/machines/control1/virtualbox/id"
 touch "$virtualbox_root/control1/control1.vbox" "$virtualbox_root/control1/disk.vdi" \
   "$virtualbox_root/unmarked/unmarked.vbox"
 
@@ -52,6 +52,7 @@ output="$test_root/output.txt"
 if PATH="$fake_bin:$PATH" \
   HOME="$test_root/home" \
   K3S_CI_MOLECULE_ROOT="$molecule_root" \
+  K3S_CI_MOLECULE_PROJECT=k3s-ansible \
   K3S_CI_VIRTUALBOX_ROOT="$virtualbox_root" \
   K3S_CI_HOSTONLY_MARKER="$test_root/hostonly-baseline" \
   FAKE_VM_MODE=fault \
@@ -62,12 +63,13 @@ if PATH="$fake_bin:$PATH" \
   exit 1
 fi
 grep -Fq 'cleanup refused: unable to inspect VirtualBox VM' "$output"
-[[ -f "$molecule_root/repo/single_node/.vagrant/machines/control1/virtualbox/id" ]]
+[[ -f "$molecule_root/k3s-ansible/single_node/.vagrant/machines/control1/virtualbox/id" ]]
 
 printf '%s\n' 'vboxnet0|192.168.30.1' > "$test_root/hostonly-baseline"
 if PATH="$fake_bin:$PATH" \
   HOME="$test_root/home" \
   K3S_CI_MOLECULE_ROOT="$molecule_root" \
+  K3S_CI_MOLECULE_PROJECT=k3s-ansible \
   K3S_CI_VIRTUALBOX_ROOT="$virtualbox_root" \
   K3S_CI_HOSTONLY_MARKER="$test_root/hostonly-baseline" \
   FAKE_HOSTONLY_FAIL=true \
@@ -82,6 +84,7 @@ grep -Fq 'cleanup refused: unable to inventory VirtualBox host-only interfaces'
 PATH="$fake_bin:$PATH" \
   HOME="$test_root/home" \
   K3S_CI_MOLECULE_ROOT="$molecule_root" \
+  K3S_CI_MOLECULE_PROJECT=k3s-ansible \
   K3S_CI_VIRTUALBOX_ROOT="$virtualbox_root" \
   K3S_CI_HOSTONLY_MARKER="$test_root/hostonly-baseline" \
   FAKE_VBOX_ROOT="$virtualbox_root" \
@@ -94,6 +97,7 @@ grep -Fq 'Would remove VM control1 (11111111-1111-1111-1111-111111111111)' "$out
 PATH="$fake_bin:$PATH" \
   HOME="$test_root/home" \
   K3S_CI_MOLECULE_ROOT="$molecule_root" \
+  K3S_CI_MOLECULE_PROJECT=k3s-ansible \
   K3S_CI_VIRTUALBOX_ROOT="$virtualbox_root" \
   K3S_CI_HOSTONLY_MARKER="$test_root/hostonly-baseline" \
   FAKE_VBOX_ROOT="$virtualbox_root" \
@@ -108,6 +112,7 @@ grep -Fq 'unregistervm unregistervm 11111111-1111-1111-1111-111111111111 --delet
 PATH="$fake_bin:$PATH" \
   HOME="$test_root/home" \
   K3S_CI_MOLECULE_ROOT="$molecule_root" \
+  K3S_CI_MOLECULE_PROJECT=k3s-ansible \
   K3S_CI_VIRTUALBOX_ROOT="$virtualbox_root" \
   K3S_CI_HOSTONLY_MARKER="$test_root/hostonly-baseline" \
   FAKE_VM_MODE=missing \
@@ -116,6 +121,6 @@ PATH="$fake_bin:$PATH" \
   bash "$repo_root/.github/scripts/cleanup-runner-resources.sh" --apply > "$output"
 
 grep -Fq 'Stale Vagrant state without a registered VM' "$output"
-[[ ! -d "$molecule_root/repo/single_node/.vagrant" ]]
+[[ ! -d "$molecule_root/k3s-ansible/single_node/.vagrant" ]]
 
 printf 'cleanup-runner-resources fixture test passed\n'