ygg-verify: jobs run at nice 10 and idle IO inside the container

nice on the docker client never reached the job, which containerd starts.
On 2026-10-31 three verify jobs held Yggdrasil's IO pressure near 75% full
and the swarm's turns slowed; idle IO lets the swarm go first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/stopgap/ygg-verify.sh

@@ -401,14 +401,18 @@ if [ "$host_mode" = 1 ]; then
   # command's status comes from the host command, not from a killed container).
   if [ -e "$killed" ]; then status=124; fi
 else
-sudo nice -n 10 docker run --rm --name "$cname" --label "$label" --cpus="$cpus" --memory="$mem" \
+# Priority is set inside the container: nice on the docker client does not reach a process
+# containerd starts. Jobs run at nice 10 and idle IO class, so the swarm's daemons and turns
+# on the same disk go first (2026-10-31: three verify jobs held IO pressure at ~75% full).
+sudo docker run --rm --name "$cname" --label "$label" --cpus="$cpus" --memory="$mem" \
   -v "$work:/src" -v /etc/machine-id:/etc/machine-id:ro \
   -v eureka-cargo-registry:/usr/local/cargo/registry -v eureka-nuget:/root/.nuget/packages \
   -v eureka-sccache:/sccache \
   -e BASH_ENV=/tmp/.ygg-bash-env ${nonce:+-e YGG_NONCE=$nonce} \
   -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory -e GIT_CONFIG_VALUE_0='*' \
   $docker_args \
-  -w /src "$image" bash -o pipefail -c "printf 'set -o pipefail\n' >/tmp/.ygg-bash-env; $cmd"
+  -w /src "$image" sh -c 'if command -v ionice >/dev/null 2>&1; then exec nice -n 10 ionice -c3 "$@"; else exec nice -n 10 "$@"; fi' sh \
+  bash -o pipefail -c "printf 'set -o pipefail\n' >/tmp/.ygg-bash-env; $cmd"
 status=$?
 fi
 set -e