fix(auth): close cancellation and workspace races

tools/tht/internal/compose/runner.go

@@ -31,8 +31,6 @@ var ErrProcessReap = errors.New("Docker command process could not be reaped")
 // ErrContainerCleanup reports that Docker could not confirm removal of a named one-shot container.
 var ErrContainerCleanup = errors.New("Docker one-shot container cleanup failed")
 
-var terminateProcessForRunner = terminateProcess
-
 // CaptureLimits bounds each captured stream while the child is running.
 type CaptureLimits struct {
 	StdoutBytes int
@@ -115,7 +113,8 @@ func (r execRunner) runBounded(ctx context.Context, args []string, stdin io.Read
 	stderr := newCappedBuffer(limits.StderrBytes, overflow, stderrObserver)
 	command.Stdout = stdout
 	command.Stderr = stderr
-	if err := command.Start(); err != nil {
+	process, err := startProcessForRunner(command)
+	if err != nil {
 		return startFailure(err)
 	}
 	done := make(chan error, 1)
@@ -128,16 +127,19 @@ func (r execRunner) runBounded(ctx context.Context, args []string, stdin io.Read
 	case <-ctx.Done():
 		interrupted = true
 		processErr = ctx.Err()
-		if err := terminateProcessForRunner(command, done); err != nil {
-			lifecycleErr = errors.Join(lifecycleErr, ErrProcessReap)
+		if err := terminateProcessForRunner(process, done); err != nil {
+			lifecycleErr = errors.Join(lifecycleErr, err)
 		}
 	case <-overflow:
 		interrupted = true
 		processErr = ErrOutputLimit
-		if err := terminateProcessForRunner(command, done); err != nil {
-			lifecycleErr = errors.Join(lifecycleErr, ErrProcessReap)
+		if err := terminateProcessForRunner(process, done); err != nil {
+			lifecycleErr = errors.Join(lifecycleErr, err)
 		}
 	}
+	if err := process.close(); err != nil {
+		lifecycleErr = errors.Join(lifecycleErr, ErrProcessReap, err)
+	}
 	if containerName != "" {
 		if err := r.cleanupOneShotContainer(containerName); err != nil {
 			lifecycleErr = errors.Join(lifecycleErr, ErrContainerCleanup)