fix(drone-dep): ADV-drone-02 — teardown fallback when SSO enrichment fails after deploy

When _enrich_deps_with_sso raises after deploy_deps succeeds (e.g., gitea API
call fails), deps_state stays {} and the finally block's `if deps_state:` guard
skips teardown, orphaning the dep at its deterministic domain.

Fix: add an `else` branch after the `if deps_state:` block that reads
$CCCI_DEPS_FILE (the legacy-list written by deploy_deps) and calls
teardown_deps on the cold entries so no dep is left running.

Unit tests: test_load_run_state_provides_fallback_for_enrichment_failure and
test_fallback_skips_warm_entries verify the data-flow that the fallback relies on.
19/19 unit tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

runner/run_recipe_ci.py

@@ -1221,6 +1221,23 @@ def main() -> int:
             except lifecycle.TeardownError as e:
                 dep_teardown_error = str(e)
                 print(f"!! {dep_teardown_error}", flush=True)
+        else:
+            # ADV-drone-02 fix: deps_state is empty (enrichment failed after a successful
+            # deploy_deps call). The raw deployed list is still in $CCCI_DEPS_FILE — read it
+            # and tear down any cold deps so they don't orphan at their deterministic domain.
+            raw = deps_mod.load_run_state()
+            if raw:
+                cold_raw = [
+                    e
+                    for e in (raw if isinstance(raw, list) else list(raw.values()))
+                    if isinstance(e, dict) and not e.get("warm")
+                ]
+                if cold_raw:
+                    print(
+                        "\n===== DEPS teardown (enrichment-failure fallback) =====", flush=True
+                    )
+                    with contextlib.suppress(lifecycle.TeardownError):
+                        deps_mod.teardown_deps(cold_raw)
 
     # ---- deploy-count assertion (DG4.1) ----
     with open(countfile) as f: