ci: boot-test changed games before publishing

Only games whose folder changed are boot-tested (against the previous
main commit, or against main on branches; manual runs pick games). Each
one is deployed by the node-agent's real deploy code on a dedicated
game-test runner, in a network that can reach the internet but not the
LAN. Publishing to the panel runs only if they all booted.

- boottest-payload builds the DEPLOY_SERVER message the panel would send
- readyPattern/failPatterns in game.yaml; readyExample in test.yaml is
  checked against the pattern during validation
- secrets in test.yaml come from CI; a game missing one is skipped
- Minecraft gets a ready pattern; Dragonwilds needs DRAGONWILDS_OWNER_ID
- RUNNER.md + scripts/runner: runner, isolated network, systemd unit

Also fixes newline values ("\n" separators/footers) that yaml.v3 wrote
as "" on import, which would have broken ARK and Dragonwilds config
files once synced, and adds a round-trip test for the importer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/validate.yml

@@ -1,11 +1,16 @@
 name: Validate game templates
 
 # Push-only on purpose: this repo is public, and a pull_request trigger would run a fork's
-# version of this workflow on our self-hosted runner. PRs from branches in this repo are
+# version of this workflow on our self-hosted runners. PRs from branches in this repo are
 # still checked through their push.
 on:
   push:
   workflow_dispatch:
+    inputs:
+      games:
+        description: "Games to boot-test: comma-separated ids, or 'all'"
+        required: true
+        default: all
 
 env:
   PANEL_WEBHOOK_URL: https://api.gbrhosting.com/api/v1/webhooks/gitea
@@ -13,6 +18,73 @@ env:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    outputs:
+      games: ${{ steps.changed.outputs.games }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Validate
+        run: |
+          go test ./...
+          go run ./cmd/gbrgames validate
+
+      # main: games changed since the previous main commit. Branches: games changed against main,
+      # so results show up before merging. Manual runs pick their own.
+      - name: Find changed games
+        id: changed
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            games=$(scripts/changed-games.sh "${{ inputs.games }}")
+          elif [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            before="${{ github.event.before }}"
+            if [ -z "$before" ] || ! git cat-file -e "$before" 2>/dev/null; then
+              games=$(scripts/changed-games.sh all)
+            else
+              games=$(scripts/changed-games.sh "$before" "${{ github.sha }}")
+            fi
+          else
+            games=$(scripts/changed-games.sh "$(git merge-base origin/main HEAD)" HEAD)
+          fi
+          echo "Games to boot-test: ${games:-none}"
+          echo "games=$(echo $games)" >> "$GITHUB_OUTPUT"
+
+  boot-test:
+    needs: validate
+    if: needs.validate.outputs.games != ''
+    # A dedicated runner on VM 116 whose game containers can reach the internet but not the LAN
+    runs-on: game-test
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      # Secrets named in a game's test.yaml must be listed here to reach the boot test
+      - name: Boot test changed games
+        env:
+          DRAGONWILDS_OWNER_ID: ${{ secrets.DRAGONWILDS_OWNER_ID }}
+        run: scripts/boot-test.sh ${{ needs.validate.outputs.games }}
+
+  # main is the source of truth: send every template to the panel, which saves the changed ones
+  # (new games arrive disabled). Runs only if the changed games booted, or none changed.
+  publish:
+    needs: [validate, boot-test]
+    if: >-
+      always() && github.ref == 'refs/heads/main' && github.event_name == 'push'
+      && needs.validate.result == 'success'
+      && (needs.boot-test.result == 'success' || needs.boot-test.result == 'skipped')
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -22,14 +94,9 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Validate
-        run: go run ./cmd/gbrgames validate
-
-      # main is the source of truth: send every template to the panel, which upserts them
-      # (new games arrive disabled). Unlike the node-agent notify, a failure here fails the run,
-      # because the panel would otherwise keep serving the previous templates silently.
+      # Unlike the node-agent notify, a failure here fails the run, because the panel would
+      # otherwise keep serving the previous templates silently.
       - name: Publish to Control Panel
-        if: github.ref == 'refs/heads/main'
         env:
           PANEL_WEBHOOK_SECRET: ${{ secrets.PANEL_WEBHOOK_SECRET }}
         run: |