[nfebe]

A run cancelled or timed out while its container was being created left that container behind until the agent restarted. Creation now finishes before the cancellation applies, and anything it made is removed.

[sourceant]

Code Review Summary

Container creation is now wrapped so it finishes under a detached, one-minute-bounded context even when the caller's context ends, then fails with the caller's context error and destroys whatever the daemon created. A pre-flight context check avoids contacting the daemon at all when the caller is already done. Firecracker's root-image preparation uses the same wrapper, so its container is cleaned up too. Tests exercise cancellation reaching the daemon across both runtimes.

🚀 Key Improvements

• Orphaned containers from cancelled creates are destroyed via DestroyByID instead of waiting for an agent restart.
• Already-cancelled calls short-circuit before the daemon is contacted.
• Firecracker root-image creation inherits the same cleanup path.

📉 Regressions

• A create cancelled mid-flight now blocks until the daemon call finishes, up to one minute, before returning.

[sourceant]

Review complete. See the overview comment for a summary.