Harden macos runner cleanup

nixos/modules/burrow-forgejo-nsc.nix

@@ -150,6 +150,38 @@ in {
         description = "Allow placeholder values (PENDING-) in the autoscaler config.";
       };
     };
+
+    pruneRunners = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Enable periodic pruning of stale Forgejo action runners.";
+      };
+
+      ttlSeconds = mkOption {
+        type = types.ints.positive;
+        default = 3600;
+        description = "Age threshold in seconds before offline runners are marked deleted.";
+      };
+
+      onBootSec = mkOption {
+        type = types.str;
+        default = "15m";
+        description = "How long after boot to wait before the first prune run.";
+      };
+
+      onUnitActiveSec = mkOption {
+        type = types.str;
+        default = "1h";
+        description = "How often to rerun stale runner pruning.";
+      };
+
+      randomizedDelaySec = mkOption {
+        type = types.str;
+        default = "10m";
+        description = "Randomized delay applied to the prune timer.";
+      };
+    };
   };
 
   config = mkIf cfg.enable {
@@ -230,5 +262,35 @@ in {
         tokenSync
       ]);
     };
+
+    systemd.services.forgejo-prune-runners = mkIf cfg.pruneRunners.enable {
+      description = "Prune offline Forgejo action runners";
+      after = [ "forgejo.service" ];
+      requires = [ "forgejo.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "forgejo";
+        Group = "forgejo";
+      };
+      environment = {
+        FORGEJO_PRUNE_DB = "1";
+        FORGEJO_RUNNER_TTL_SEC = toString cfg.pruneRunners.ttlSeconds;
+      };
+      path = [ pkgs.python3 pkgs.postgresql ];
+      script = ''
+        ${pkgs.python3}/bin/python3 ${self}/Scripts/forgejo-prune-runners.py
+      '';
+    };
+
+    systemd.timers.forgejo-prune-runners = mkIf cfg.pruneRunners.enable {
+      description = "Periodic Forgejo runner cleanup";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = cfg.pruneRunners.onBootSec;
+        OnUnitActiveSec = cfg.pruneRunners.onUnitActiveSec;
+        RandomizedDelaySec = cfg.pruneRunners.randomizedDelaySec;
+        Unit = "forgejo-prune-runners.service";
+      };
+    };
   };
 }