fix(boot-test): never overwrite non-password settings

The payload builder filled anything matching the validator's broad
credential pattern that wasn't a non-empty string, so RCON_PORT,
ENABLE_RCON and ARK's RCONEnabled/RCONPort became 'boot-123456' in the
first runner run. Only fill keys named like passwords (or x-generate),
and only when missing or an empty string. Adds a test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/gbrgames/boottest.go

@@ -21,6 +21,10 @@ const bootTestNetwork = "gbr-boottest"
 var publicPort = regexp.MustCompile(`\{PUBLIC_PORT_(\d+)\}`)
 var savedValue = regexp.MustCompile(`\{saved:[A-Za-z0-9_.-]+\}`)
 
+// Narrower than the validator's sensitiveKey: that one also matches settings like RCON_PORT, which
+// are fine to flag as "don't put secrets here" but must never be overwritten with a password.
+var passwordKey = regexp.MustCompile(`(?i)(pass(word)?|secret|token)`)
+
 // runBootTestPayload writes the DEPLOY_SERVER message the panel would send for this game, plus the
 // boot-test settings the node-agent's BootTest reads. Secrets come from environment variables named
 // in test.yaml's 'secrets'.
@@ -71,10 +75,12 @@ func runBootTestPayload(args []string) error {
 	// would type in, and some games refuse to start without) get a throwaway value too
 	for key, p := range schemaProperties(g) {
 		prop, _ := p.(map[string]any)
-		if prop["x-generate"] != nil || sensitiveKey.MatchString(key) {
-			if s, _ := config[key].(string); s == "" {
-				config[key] = "boot-" + randomSuffix()
-			}
+		if prop["x-generate"] == nil && !passwordKey.MatchString(key) {
+			continue
+		}
+		// Only missing or empty text: ports, booleans and other values are never touched
+		if v, present := config[key]; !present || v == "" {
+			config[key] = "boot-" + randomSuffix()
 		}
 	}
 	for k, v := range config {