ci: boot-test changed games before publishing

Only games whose folder changed are boot-tested (against the previous
main commit, or against main on branches; manual runs pick games). Each
one is deployed by the node-agent's real deploy code on a dedicated
game-test runner, in a network that can reach the internet but not the
LAN. Publishing to the panel runs only if they all booted.

- boottest-payload builds the DEPLOY_SERVER message the panel would send
- readyPattern/failPatterns in game.yaml; readyExample in test.yaml is
  checked against the pattern during validation
- secrets in test.yaml come from CI; a game missing one is skipped
- Minecraft gets a ready pattern; Dragonwilds needs DRAGONWILDS_OWNER_ID
- RUNNER.md + scripts/runner: runner, isolated network, systemd unit

Also fixes newline values ("\n" separators/footers) that yaml.v3 wrote
as "" on import, which would have broken ARK and Dragonwilds config
files once synced, and adds a round-trip test for the importer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RUNNER.md

@@ -0,0 +1,55 @@
+# Boot-test runner setup
+
+Boot tests run on a dedicated Gitea Actions runner labelled `game-test`. It deploys each changed game
+with the node-agent's real deploy code, inside a Docker network that can reach the internet (Steam,
+Mojang, plugin downloads) but **not** private networks or the host. `scripts/boot-test.sh` refuses to
+run if that network is missing, so a half-configured runner can't boot servers on the LAN.
+
+Everything here runs on the runner VM as root.
+
+## 1. Isolated network
+
+```bash
+mkdir -p /opt/gbr-boottest
+cp scripts/runner/setup-boottest-network.sh /opt/gbr-boottest/
+chmod +x /opt/gbr-boottest/setup-boottest-network.sh
+cp scripts/runner/gbr-boottest-network.service /etc/systemd/system/
+systemctl daemon-reload
+systemctl enable --now gbr-boottest-network
+```
+
+Check it from a throwaway container: the first command should print an IP, the second should time out.
+
+```bash
+docker run --rm --network gbr-boottest curlimages/curl -s --max-time 5 https://ifconfig.me
+docker run --rm --network gbr-boottest curlimages/curl -s --max-time 5 http://192.168.1.1 || echo blocked
+```
+
+## 2. The runner
+
+1. In Gitea: **gbreed-public → Settings → Actions → Runners → Create new runner**, and copy the token.
+2. On the VM:
+
+```bash
+mkdir -p /opt/gitea-game-test-runner && cd /opt/gitea-game-test-runner
+cp <repo>/scripts/runner/docker-compose.yml <repo>/scripts/runner/config.yaml .
+echo "GITEA_RUNNER_REGISTRATION_TOKEN=<token>" > .env
+docker compose up -d
+```
+
+The runner shows up as `game-test` in the org's runner list. It takes one job at a time; the build
+runner keeps handling everything else.
+
+## 3. Secrets
+
+Games whose `test.yaml` maps a value under `secrets` are skipped until that Actions secret exists in
+the org or repo, and the workflow passes it through (see the `env:` of the boot-test step).
+
+| Secret | Game | What |
+| --- | --- | --- |
+| `DRAGONWILDS_OWNER_ID` | RuneScape: Dragonwilds | A Player ID; the server won't start without one |
+
+## Housekeeping
+
+Game images and SteamCMD downloads add up. A weekly `docker system prune -af --filter "until=168h"`
+(cron or a systemd timer) keeps the disk in check; each test removes its own container and volume.