fix: clean up bind_workdir workspace after job execution

When bind_workdir is enabled, workspace directories persist on the host
after container removal. Clean them up after job execution to prevent
stale files from accumulating.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/app/run/runner.go

@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"maps"
+	"os"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -245,6 +246,13 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 
 	execErr := executor(ctx)
 	reporter.SetOutputs(job.Outputs)
+
+	if r.cfg.Container.BindWorkdir {
+		if err := os.RemoveAll(runnerConfig.Workdir); err != nil {
+			log.Warnf("failed to clean up workspace %s: %v", runnerConfig.Workdir, err)
+		}
+	}
+
 	return execErr
 }