Harden macos runner cleanup

services/forgejo-nsc/README.md

@@ -45,6 +45,9 @@ profile. The important knobs are:
 - `namespace.machine_type` / `namespace.duration` – shape + TTL for the ephemeral
   Namespace environment. The dispatcher destroys the instance after a job so the
   TTL acts as a hard cap, not an idle timeout.
+- macOS fallback launches still use `nsc create`, but bootstrap runs over the
+  Compute SSH config endpoint instead of `nsc ssh` so the dispatcher can always
+  destroy the instance itself instead of relying on a websocket SSH proxy handoff.
 - `namespace.linux_cache_*` / `namespace.macos_cache_*` – persistent cache
   volumes mounted into runners so Linux can keep `/nix` plus shared build
   caches warm and macOS can reuse Rust toolchains, Xcode package caches, and
@@ -176,6 +179,9 @@ Long-lived runtime state is now sourced from age-encrypted files:
 After refreshing the encrypted secrets, deploy the forge host so
 `config.age.secrets.*` updates the live paths for `services.burrow.forge`,
 `services.burrow.forgeRunner`, and `services.burrow.forgejoNsc`.
+The Nix host module also installs a periodic `forgejo-prune-runners` timer that
+marks stale offline runners deleted in Forgejo's database so wedged instances do
+not leave the queue polluted indefinitely.
 
 Run it next to the dispatcher: