P1 security batch: quota execution checks, cost accounting, goal/coordinator semantics, PR channel, orphan signature, control-plane and console hardening

- Docker quota watchdog + fail-closed quota checks, system tasks need real owner
- max_cost_usd actually accumulated, cancel records cost, estimated rows excluded from unpriced cap, cache_write declared non-billed
- goal-resume keeps original verify on breakpoint resume, goal retry falls back to resume, goal_max_rounds capped at 100 at create and execution
- coordinator children inherit parent model/effort, orphans marked interrupted with audit
- PR jobs on docker workers return explicit needs_local_worker instead of silent empty
- worker code signature covers 6 files and is checked before claim, fail-closed
- sub2api lazy provisioning with rotation, backup whitelist + 0600, push SSRF block, repos/workers desensitized, key/project audits and limits, console buttons/quota/status wording, coordinator/automation quota reserve

cloud/coordinator.py

@@ -16,6 +16,15 @@
   超时时同样取消挂起的子任务并标 failed，报告里写清哪几项
   没完成。取消路径的协调员标 interrupted，不发完成/失败推送
   （与普通任务的取消口径一致）。
+- 孤儿收口（P1）：协调员本身死亡（worker 进程死、VM 回收）
+  时没有“取消者”替它取消子任务，正在跑的子任务会无声继续
+  烧钱。worker 侧两道收口：① 协调员取消/超时终局时，cancel
+  之后仍未终态的子任务由 _coord_mark_orphans 直接标
+  interrupted 并记审计；② 常驻循环每轮的
+  sweep_orphaned_coordinator_children 把“父已终态（或父行
+  已失踪）但子仍未终态”的子任务统一标 interrupted 并记审计
+  （父仍在跑时绝不动子任务）。本模块只提供纯函数
+  nonterminal_children 供 worker 判断，DB 写回在 worker 侧。
 
 本模块只放纯逻辑（校验、解析、汇总、建表），不碰 DB 之外的
 任何东西，单测不需要 worker/server。
@@ -128,6 +137,28 @@ def ensure_columns(conn):
                 pass
 
 
+TERMINAL_STATUSES = frozenset(
+    {"completed", "failed", "interrupted", "merged", "merge-failed"})
+
+
+def nonterminal_children(children):
+    """未终态的子任务（P1 孤儿判断用，纯函数）。
+
+    children 为 [{name, id, status, ...}]（worker 的 _coord_child_rows
+    拼出来的 merged 形态，或 _coord_sync_children 的 [{name, id}]
+    补上 status 后的形态）；返回其中 status 不在终态集里的项
+    （缺 status 按未终态算，绝不把“查不到”当成“已完成”）。
+    worker 的孤儿标记与取消/超时终局都以它为准。
+    """
+    out = []
+    for ch in children or []:
+        if not isinstance(ch, dict):
+            continue
+        if ch.get("status") not in TERMINAL_STATUSES:
+            out.append(ch)
+    return out
+
+
 def build_report(children):
     """合流汇总：children 为 [{name, id, status, result_text,
     error_text}]，返回 (report_text, overall_status)。