fix(engine): install wireguard-tools + bring up wg0; lock-coordinate host removal

- Image installs wireguard-tools/iproute2; the provisioning worker brings up
  wg0 before queue:work so LocalWireguardHub can manage peers.
- ConfirmRemoveHost deletes each run under its run:<uuid> lock so an in-flight
  worker can't keep mutating the server or write to a deleted run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Livewire/Admin/ConfirmRemoveHost.php

@@ -4,6 +4,7 @@ namespace App\Livewire\Admin;
 
 use App\Models\Host;
 use App\Services\Wireguard\WireguardHub;
+use Illuminate\Support\Facades\Cache;
 use LivewireUI\Modal\ModalComponent;
 
 /**
@@ -27,12 +28,20 @@ class ConfirmRemoveHost extends ModalComponent
         $host = Host::query()->where('uuid', $this->uuid)->first();
 
         if ($host !== null) {
-            // Drop the hub peer first so its wg_ip can't later be reused while a
+            // Delete each run under its runner lock so an in-flight worker can't
-            // stale peer still routes to the removed server.
+            // keep mutating the server or write an event against a deleted run.
+            foreach ($host->runs()->get() as $run) {
+                Cache::lock('run:'.$run->uuid, 30)->block(15, function () use ($run) {
+                    $run->delete(); // cascades run_resources + step_events
+                });
+            }
+
+            // Drop the hub peer so its wg_ip can't later be reused while a stale
+            // peer still routes to the removed server.
             if (filled($host->wg_pubkey)) {
                 $hub->removePeer($host->wg_pubkey);
             }
-            $host->runs()->delete();   // cascades run_resources + step_events
+
             $host->delete();
         }
 

docker-compose.yml

@@ -61,7 +61,9 @@ services:
   queue-provisioning:
     image: clupilot-app:dev
     restart: unless-stopped
-    command: php artisan queue:work provisioning --queue=provisioning --tries=1 --timeout=2100 --sleep=3
+    # Bring up wg0 (from the mounted config, once the operator has installed it)
+    # before starting the worker, so LocalWireguardHub can manage peers.
+    command: sh -c 'wg-quick up wg0 2>/dev/null || true; exec php artisan queue:work provisioning --queue=provisioning --tries=1 --timeout=2100 --sleep=3'
     cap_add:
       - NET_ADMIN
     devices:

docker/php/Dockerfile

@@ -11,6 +11,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         nginx supervisor git unzip curl ca-certificates gnupg \
         libpng-dev libjpeg62-turbo-dev libfreetype6-dev \
         libzip-dev libonig-dev libicu-dev \
+        wireguard-tools iproute2 openssh-client \
     && rm -rf /var/lib/apt/lists/*
 
 # --- php extensions --------------------------------------------------------