runner: never embed a fossil screenshot from a collided run dir

!testme gitea PR #10 (drone build 35, 2026-10-05) rendered a summary card whose
app screenshot was custom-html-tiny's — a fossil from a May-31 run dir with the
same number. Root cause chain:
- /var/lib/cc-ci-runs/ keeps old-era run dirs numbered up to 1377; drone's
  build counter restarted when its DB was re-created (2026-09-27), so new
  builds collide with old dirs (35 was one).
- the run reused the collided dir without cleaning it: fresh results.json/
  summary.* landed NEXT TO the old screenshot.png.
- screenshot.capture()'s SCREENSHOT-hook branch skipped the actual snap when
  out_path already existed ('the hook may have saved it' — no hook does), so
  capture() 'succeeded' without writing and the card embedded the fossil.

Fix, cosmetics-only (R7 — verdict logic untouched):
- results.fresh_artifact_dir(): at run start, remove ONLY the files/dirs this
  run owns (results.json, summary.*, badge.svg, lint.txt, screenshot.png,
  junit/) from its artifact dir; anything else is left alone; never raises.
- run_recipe_ci calls it right after computing run_artifact_dir.
- screenshot.capture(): the hook branch ALWAYS snaps (same settle/blank-retry
  path as the default branch) — a pre-existing file is never trusted.

Unit tests: fresh_artifact_dir (owned-only removal, dir creation, odd entries)
+ capture() fake-playwright regression proving a fossil out_path is overwritten.

runner/harness/screenshot.py

@@ -142,12 +142,13 @@ def capture(domain: str, out_path: str, *, recipe_meta: dict | None = None) -> s
                 page = context.new_page()
                 if hook is not None:
                     # Recipe-specific safe view (post-login etc.). The hook owns navigation +
-                    # the no-secret-page guarantee; it should call page.screenshot itself, but if
-                    # it doesn't, we still snap the resulting page below. SCREENSHOT(page, ctx) —
-                    # the uniform ctx convention (rcust P3).
+                    # the no-secret-page guarantee; we ALWAYS snap the page after it returns.
+                    # Never trust a pre-existing out_path: a recycled run artifact dir (drone
+                    # build numbers restarted 2026-09-27 while old-era dirs linger) must not get
+                    # its fossil screenshot embedded (observed 2026-10-05, !testme gitea #10
+                    # build 35). SCREENSHOT(page, ctx) — the uniform ctx convention (rcust P3).
                     hook(page, meta_mod.hook_ctx(domain, recipe_meta))
-                    if not os.path.exists(out_path):
-                        _snap_with_blank_retry(page, out_path)
+                    _snap_with_blank_retry(page, out_path)
                 else:
                     # Default: landing page. Accept any rendered status (200 or an auth redirect to a
                     # login form) — both are credential-free and representative of "the app is up".