Remove the clone container even when the deploy is cancelled (closes #215)

The deferred removal used the deploy context, so a cancelled deploy
(a newer push, or the build timeout) never sent the remove request and
left the clone container and its volume behind. It now uses
context.WithoutCancel, and the test gains a case that cancels the
context while the clone is running.

Model: opus-5-5

internal/docker/client.go

@@ -657,10 +657,11 @@ func (c *Client) performClone(
 	}
 
 	// The git image declares a volume, so Docker gives each clone container
-	// an anonymous volume; remove it with the container.
+	// an anonymous volume; remove it with the container. The removal must
+	// still run when the deploy is cancelled.
 	defer func() {
 		_ = c.docker.ContainerRemove(
-			ctx,
+			context.WithoutCancel(ctx),
 			gitContainerID.String(),
 			container.RemoveOptions{Force: true, RemoveVolumes: true},
 		)