build / build (push) Successful in 3m24s
Under `set -e` any failure between mktemp and the trailing rm -rf exits the step first and leaks the checkout into /tmp — which is tmpfs on srv, so the leak is RAM. 44 leaked dirs / 4.1G had accumulated by 2026-08-13 (node-identity.yml additionally never removed $WORK at all). Same trap idiom psn-base/bootstrap.sh and the ops/bawnet workflows already use. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>