fix(installer): give TestGen time to stop before docker kills it

[rboni-dk]

Why

TestGen's scheduler stops cooperatively: on SIGTERM it asks running jobs to stop at a checkpoint, waits up to TG_JOB_SHUTDOWN_TIMEOUT (default 60s), and records where each one got to so the next start continues from there.

Docker's default stop grace period is 10s, so a stop, restart, or upgrade killed the container mid-wait — the checkpoint was never written and the run started over from nothing. A large profiling run can be many minutes of work.

Measured

Same job, same 30s columns, only the grace period differs:

Grace	Stop took	Exit	Outcome
10s (old default)	10s	137 SIGKILL	stranded -> canceled next start, 38 columns discarded
90s (this PR)	53s	0	interrupted, checkpoint kept, resumed

docker compose down behaves the same (52s, checkpoint kept), which is the path tg upgrade and tg delete use.

90s clears the 60s wait plus the final write, and matches what TestGen ships in its own compose files and Helm chart.

What changed

The compose template alone would reach only new installs, so this lands in three places:

• Generated compose file - fresh Docker installs.
• tg upgrade - patches the compose file in place. CreateComposeFileStepBase reuses an existing file, so this is the only path that reaches current users. Scoped to the engine service by indentation via a new find_in_block helper, and matched on the image key rather than its value so a private-mirror install is patched too.
• Pip mode - stop_app_tree force-killed the tree after 10s. It now waits the same grace period, reports whether the stop was clean, and swallows a second Ctrl+C rather than letting it re-signal the tree (TestGen reads a second signal as "hurry up" and cuts the job mid-pause).

The force-kill path also sweeps orphans now: run-app all starts its ui/scheduler children in their own sessions, so killpg on the parent left them holding the port and data directory, breaking the next tg start.

Known limits

• Windows still force-kills - no catchable signal is deliverable without CREATE_NEW_PROCESS_GROUP, and TestGen's own _forward_signal_to_child force-kills children there regardless. The Ctrl+C messaging is gated on this so it neither promises a wait it cannot honor nor warns about a lost job on every stop.
• A column longer than TG_JOB_SHUTDOWN_TIMEOUT is still cut. Verified: a 150s column overruns the 90s grace and is SIGKILLed. No grace period fixes a step with no interior stop check.

Testing

207 unit/integration tests pass; ruff clean. Behaviour verified end-to-end against a locally built TestGen image carrying the cooperative-shutdown work, across five scenarios (fast columns, slow columns, the 10s counterfactual, a column exceeding the grace, and compose down).

🤖 Generated with Claude Code

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
dk-installer.py	1852	437	76%	159–160, 164–165, 177–189, 217–218, 221, 226–230, 240–241, 250–262, 267, 280, 326–327, 386, 426–433, 440, 452, 474–475, 519, 569–572, 591–592, 594, 644–673, 677–714, 745–763, 834, 905–906, 974, 991–992, 1009–1014, 1088–1089, 1099, 1115–1119, 1122, 1125, 1128, 1139–1172, 1275, 1281, 1327, 1330, 1337–1338, 1344–1346, 1446–1457, 1506–1521, 1524–1535, 1552–1553, 1590–1591, 1617–1618, 1625, 1630, 1636–1637, 1670–1673, 1682–1683, 1688–1689, 1705–1716, 1762–1764, 1974–2013, 2054–2057, 2149–2152, 2189, 2218, 2243–2245, 2253–2255, 2313, 2315, 2317, 2432–2433, 2451, 2481, 2490, 2493–2495, 2538–2550, 2555–2562, 2570–2580, 2677–2722, 2762–2763, 2777, 2836, 2948–3018, 3021–3023, 3026–3028, 3099, 3142–3160, 3164, 3169, 3221–3223, 3226–3228, 3254–3257, 3276–3292, 3295–3297, 3300–3302, 3326–3331, 3347–3349, 3385–3393, 3396–3398, 3406–3410, 3474–3476, 3483–3485, 3496–3499, 3504–3505, 3511–3512, 3523–3532, 3541–3595, 3599–3635, 3639–3654
TOTAL	1852	437	76%

Tests	Skipped	Failures	Errors	Time
207	0 💤	0 ❌	0 🔥	2.534s ⏱️