fix: IPv6 URLs, cache-server SIGTERM and atomic task admission (#1217)

Three independent fixes, one commit each.

1. Hosts and ports were interpolated directly when building URLs, so a literal IPv6 address produced an unbracketed authority, making `ACTIONS_CACHE_URL`, `ACTIONS_RUNTIME_URL` and the artifact server listener unusable. Hosts are expected bare, as documented for `cache.host`, so an address that already carries brackets is no longer accepted.
2. `cache-server` waited on its own `os.Interrupt` channel and ignored SIGTERM, so service managers and container runtimes had to kill it.
3. Task admission used a separate `Load` and `Store`, so two concurrent dispatches of the same task id could both be admitted.

Assisted-by: Claude Code:Opus 5
Co-authored-by: bircni <bircni@icloud.com>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1217
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

e2e/gitea_fixture.go

@@ -160,7 +160,7 @@ func StartGitea(ctx context.Context, cli mobyclient.APIClient) (*GiteaFixture, e
 		sharedNet, _ = selfNetwork(ctx, cli)
 	)
 	if sharedNet != "" {
-		baseURL = fmt.Sprintf("http://%s:3000", name)
+		baseURL = "http://" + net.JoinHostPort(name, "3000")
 		netConfig = &network.NetworkingConfig{
 			EndpointsConfig: map[string]*network.EndpointSettings{sharedNet: {}},
 		}
@@ -170,7 +170,7 @@ func StartGitea(ctx context.Context, cli mobyclient.APIClient) (*GiteaFixture, e
 		if err != nil {
 			return nil, fmt.Errorf("find a free host port: %w", err)
 		}
-		baseURL = fmt.Sprintf("http://%s:%d", host, port)
+		baseURL = "http://" + net.JoinHostPort(host.String(), strconv.Itoa(port))
 		hostConfig.PortBindings = network.PortMap{
 			containerPort: []network.PortBinding{{HostIP: host, HostPort: strconv.Itoa(port)}},
 		}