ci: janitor cancels jobs no runner can ever take

windy-pro alone left ~4 jobs per run waiting forever (build-electron on
macos/windows/ubuntu-latest, deploy if:false): Gitea evaluates job if:
only at pick time, the labels do not exist here, and waiting jobs are
invisible in /actions/tasks. 37 such jobs across 10 runs today. After
30 min they are cancelled and the run status recomputed. Runs each sync,
non-fatal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/cancel_unrunnable.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Cancel jobs no runner can ever take (see cancel_unrunnable.sql). Run on Veron as root.
+set -euo pipefail
+n=$(docker exec -i windy-git-db-1 sh -c 'psql -U "$POSTGRES_USER" -d gitea -At -v ON_ERROR_STOP=1' \
+      < "$(dirname "$0")/cancel_unrunnable.sql" | grep -cE '^[0-9]+$' || true)
+echo "[janitor] cancelled unrunnable jobs in ${n} run(s)"