Isolate CI Compose runtime with temporary volumes and reliable cleanup

.github/workflows/verify.yml

@@ -17,24 +17,10 @@ jobs:
       - run: python -m mypy pigway_frame_flow
       - run: python -m pytest -q
       - run: python -m pip_audit -r requirements.lock --no-deps --disable-pip
-      - run: |
-          cp .env.example .env
-          python - <<'PY'
-          from pathlib import Path
-          import secrets
-          p=Path('.env')
-          p.write_text(p.read_text().replace('FRAME_FLOW_TOKEN=\n', 'FRAME_FLOW_TOKEN='+secrets.token_urlsafe(32)+'\n'))
-          PY
+      - name: Isolated Docker build, smoke and restart verification
+        run: |
           . ./deploy/build-cn.env
-          ./scripts/build-verify.sh
-          mkdir -p data/images data/generated data/cache config
-          sudo chown -R 10333:10333 data config
-          docker compose up -d
-          for attempt in $(seq 1 30); do curl -fsS http://127.0.0.1:18787/ready >/dev/null && break || sleep 2; done
-          python scripts/smoke-test.py
-          docker compose restart pigway-frame-flow
-          for attempt in $(seq 1 30); do curl -fsS http://127.0.0.1:18787/ready >/dev/null && break || sleep 2; done
-          python scripts/smoke-test.py
-          docker inspect pigway-frame-flow --format '{{.HostConfig.RestartPolicy.Name}} {{.State.Health.Status}}'
-          docker image inspect pigway-frame-flow:latest --format '{{.Size}} {{.Architecture}}'
-          docker compose down
+          python scripts/ci-compose-verify.py
+      - name: Cleanup isolated Docker resources
+        if: always()
+        run: python scripts/ci-compose-verify.py --cleanup