fix(ci): 修復 Docker build lock stale 偵測（奈秒 + 時區縮寫解析失敗）

docker network inspect 回傳 "2026-05-03 00:07:48.009219232 +0800 CST"
date -d 不接受：(1) 奈秒小數 (2) 數字 offset + 縮寫同時存在
→ CREATED_EPOCH=0 → stale 永不觸發 → lock 最長殘留 30min 才 timeout

修法：sed 去除奈秒與末尾縮寫後再解析，Python3 作備援
stale 告警訊息加上 age 秒數，方便排查

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/cd.yaml

@@ -282,11 +282,21 @@ jobs:
             CREATED_AT=$(docker network inspect "$LOCK_NAME" \
               --format '{{.Created}}' 2>/dev/null || true)
             if [ -n "$CREATED_AT" ]; then
-              CREATED_EPOCH=$(date -d "$CREATED_AT" +%s 2>/dev/null || echo 0)
+              # 2026-05-03 ogt: 修復 stale 偵測 — Docker 回傳 "2006-01-02 15:04:05.999999999 -0700 MST"
+              # date -d 不接受奈秒小數點與末尾時區縮寫（CST/MST 等），導致 CREATED_EPOCH=0 → stale 永不觸發
+              # 修法：sed 去除奈秒 (.NNN...) 和末尾縮寫 (空格+大寫字母)，GNU date 才能正確解析
+              CREATED_CLEAN=$(echo "$CREATED_AT" | sed 's/\.[0-9]*//' | sed 's/ [A-Z][A-Z]*$//')
+              CREATED_EPOCH=$(date -d "$CREATED_CLEAN" +%s 2>/dev/null || \
+                python3 -c "
+import sys, datetime, re
+ts = re.sub(r'\.\d+', '', sys.argv[1])
+ts = re.sub(r'\s+[A-Z]{2,4}$', '', ts.strip())
+print(int(datetime.datetime.strptime(ts, '%Y-%m-%d %H:%M:%S %z').timestamp()))
+" "$CREATED_AT" 2>/dev/null || echo 0)
               NOW_EPOCH=$(date +%s)
               if [ "$CREATED_EPOCH" -gt 0 ] && \
                  [ $((NOW_EPOCH - CREATED_EPOCH)) -gt "$STALE_SECONDS" ]; then
-                echo "⚠️ stale Docker build lock detected, removing ${LOCK_NAME}"
+                echo "⚠️ stale Docker build lock detected (age=$((NOW_EPOCH - CREATED_EPOCH))s > ${STALE_SECONDS}s), removing ${LOCK_NAME}"
                 docker network rm "$LOCK_NAME" >/dev/null 2>&1 || true
                 continue
               fi