fix(placement): a drained member is where maintenance goes, not where it is refused

[rldyourmnd]

A build requires its member to be empty. The only way to empty one is drain-member. Drain closes that member's pressure gate. The gate then removes it from every candidate list — so the build reports no fleet member has room about a member with zero occupants.

Observed live

gha-runner-2 drained to zero occupants in 25 seconds, no job aborted. Then:

reconcile golden image: initialize image builder: incus command failed:
Failed instance placement scriptlet: Failed to run:
fail: insufficient-memory: no fleet member has room for this worker

The orchestrator does pass --target, with a comment explaining why. Incus runs the placement scriptlet regardless, and the scriptlet vetoes what the target selected.

Two correct guards, jointly unsatisfiable

The pressure gate exists to keep new work off a busy member. An image builder is not new work — it is the maintenance the member was emptied for. Each guard is right on its own; together they make rebuilding an image impossible while the fleet serves.

The change

The scriptlet exempts exactly the two instance names internal/imageplan generates — gha-image-builder- and gha-image-smoke- — from the gate, and from nothing else.

Memory headroom, the storage pool check and the disk reserve still apply. A build placed where it does not fit fails later and more expensively, so the exemption is narrow by construction.

Verification

TestMaintenanceInstancesIgnoreTheClosedGate asserts both halves: the exemption is present, and the capacity checks it must not weaken are still there. Verified by mutation — restoring the unconditional gate check fails it.