GRM-32: fix: security, dead code, idempotence, and documentation cleanup

ansible/remove-runner.yml

@@ -71,6 +71,11 @@
       failed_when: false
       changed_when: false
 
+    - name: Disable lingering for runner user
+      ansible.builtin.command: loginctl disable-linger "{{ gitea_runner_service_user | default('grm-' ~ runner_name) }}"
+      failed_when: false
+      changed_when: true
+
     - name: Remove runner user and home directory
       ansible.builtin.user:
         name: "{{ gitea_runner_service_user | default('grm-' ~ runner_name) }}"
@@ -79,6 +84,20 @@
       when: remove_runner_user | default(true)
       failed_when: false
 
+    - name: Remove subuid entry for runner user
+      ansible.builtin.lineinfile:
+        path: /etc/subuid
+        regexp: "^{{ gitea_runner_service_user | default('grm-' ~ runner_name) }}:"
+        state: absent
+      failed_when: false
+
+    - name: Remove subgid entry for runner user
+      ansible.builtin.lineinfile:
+        path: /etc/subgid
+        regexp: "^{{ gitea_runner_service_user | default('grm-' ~ runner_name) }}:"
+        state: absent
+      failed_when: false
+
     - name: Remove runner data directory
       ansible.builtin.file:
         path: "{{ gitea_runner_data_dir | default('/var/lib/gitea-runner/' ~ runner_name) }}"