radio: stop a dead PulseAudio from crash-looping the whole radio

Field report: the radio died and kept restarting. The log chain is
unambiguous - "Daemon startup failed" (pulse), then Connection refused on
input.pulseaudio_0 / buffer.consumer_0 / pulse_out, then "Shutdown
started!", then round again.

Three fixes:

* Clear stale pulse runtime state before starting the daemon. /run is part
  of the container's writable layer, so "docker restart" - and the loop that
  restart:unless-stopped produces - preserves /run/pulse/pid from the killed
  daemon; the next start then refuses with "Daemon startup failed", which is
  what makes the loop self-sustaining. We only remove it when no pulseaudio
  process is actually alive.

* When pulse still won't start, say so loudly and explain the consequence
  and the way out (Icecast needs no sound device; comment the pulse tor out),
  instead of a one-line WARNING that gets lost above the traceback.

* output.pulseaudio(fallible=true): the local monitor output can now fail
  without failing its clock and tearing down the radio. The mic input stays
  a hard dependency - documented inline, since removing it changes audio
  behaviour and cannot be verified without a liquidsoap runtime.

Also: RADIO_FORCE_SCRIPT=1 re-seeds radio_conjurer.liq from the image
(keeping a .bak). The live script is deliberately never overwritten so hand
edits win - but that also means image fixes never reached volumes seeded
long ago, which is why a running radio can still hold a stale script.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/entrypoint.radio.sh

@@ -11,6 +11,16 @@ CREDS="$SECRETS/icecast_credentials.json"
 mkdir -p "$DATA" "$MUSIC" "$SECRETS"
 
 # Seed the script + persistent interactive params from the image on first run.
+# NOTE: the live script is deliberately never overwritten, so hand edits win -
+# but that also means image fixes NEVER reach a volume seeded long ago. Set
+# RADIO_FORCE_SCRIPT=1 to take the image's version (the old one is kept as
+# radio_conjurer.liq.bak so nothing hand-written is lost).
+if [ -e "$DATA/radio_conjurer.liq" ] && [ "${RADIO_FORCE_SCRIPT:-0}" = "1" ]; then
+    cp "$DATA/radio_conjurer.liq" "$DATA/radio_conjurer.liq.bak"
+    cp /app/radio_conjurer.liq "$DATA/"
+    echo "RADIO_FORCE_SCRIPT=1: reseeded radio_conjurer.liq from the image" >&2
+    echo "  (previous version saved as radio_conjurer.liq.bak)" >&2
+fi
 [ -e "$DATA/radio_conjurer.liq" ] || cp /app/radio_conjurer.liq "$DATA/"
 if [ ! -e "$DATA/script.params" ]; then
     if [ -e /app/script.params ]; then cp /app/script.params "$DATA/"; else : > "$DATA/script.params"; fi
@@ -73,14 +83,36 @@ fi
 #   none               - you edited the script to drop pulse in/out.
 case "${PULSE_MODE:-internal}" in
     internal)
+        # Clear stale runtime state FIRST. `docker restart` - and the crash-loop
+        # that restart:unless-stopped produces - reuses the container's writable
+        # layer, so /run/pulse/pid left by a killed daemon survives and the next
+        # start dies with "Daemon startup failed"; that kills liquidsoap, which
+        # restarts the container, forever. Removing the pid/socket of a daemon
+        # that is demonstrably not running breaks the loop.
+        if ! pidof pulseaudio >/dev/null 2>&1; then
+            rm -f /run/pulse/pid /var/run/pulse/pid \
+                  /run/pulse/native /var/run/pulse/native 2>/dev/null || true
+        fi
         # --disallow-module-loading: modules from system.pa still load at
         # startup; this only blocks later client-requested loads (and
         # silences the system-mode warning). The "forcibly disabling SHM"
         # notice is inherent to system mode and harmless.
-        pulseaudio --system --daemonize=yes --disallow-exit \
-            --disallow-module-loading --exit-idle-time=-1 \
-            || echo "WARNING: internal pulseaudio failed to start" >&2
-        export PULSE_SERVER="${PULSE_SERVER:-unix:/var/run/pulse/native}"
+        if pulseaudio --system --daemonize=yes --disallow-exit \
+                --disallow-module-loading --exit-idle-time=-1; then
+            export PULSE_SERVER="${PULSE_SERVER:-unix:/var/run/pulse/native}"
+        else
+            # Be loud: with pulse dead, input.pulseaudio()/output.pulseaudio()
+            # fail to start, liquidsoap tears down the whole clock ("Shutdown
+            # started!") and the container crash-loops. The stream itself only
+            # needs Icecast, so the way out is dropping the pulse tor.
+            echo "ERROR: internal pulseaudio failed to start." >&2
+            echo "       Liquidsoap will crash-loop while the script still uses" >&2
+            echo "       input.pulseaudio()/output.pulseaudio(). The Icecast" >&2
+            echo "       output does NOT need pulse: comment those out in" >&2
+            echo "       $DATA/radio_conjurer.liq (or set RADIO_FORCE_SCRIPT=1" >&2
+            echo "       to re-seed the script from the image) and restart." >&2
+            echo "       Diagnose with: pulseaudio --system --daemonize=no -vvvv" >&2
+        fi
         ;;
     host)
         [ -n "$PULSE_SERVER" ] || echo "WARNING: PULSE_MODE=host but PULSE_SERVER is unset" >&2