ci: boot-test changed games before publishing

Only games whose folder changed are boot-tested (against the previous
main commit, or against main on branches; manual runs pick games). Each
one is deployed by the node-agent's real deploy code on a dedicated
game-test runner, in a network that can reach the internet but not the
LAN. Publishing to the panel runs only if they all booted.

- boottest-payload builds the DEPLOY_SERVER message the panel would send
- readyPattern/failPatterns in game.yaml; readyExample in test.yaml is
  checked against the pattern during validation
- secrets in test.yaml come from CI; a game missing one is skipped
- Minecraft gets a ready pattern; Dragonwilds needs DRAGONWILDS_OWNER_ID
- RUNNER.md + scripts/runner: runner, isolated network, systemd unit

Also fixes newline values ("\n" separators/footers) that yaml.v3 wrote
as "" on import, which would have broken ARK and Dragonwilds config
files once synced, and adds a round-trip test for the importer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/boot-test.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Boot-tests the given games with the node-agent's real deploy code, one after another.
+# Each game is deployed on this machine's Docker daemon inside the isolated gbr-boottest network and
+# must reach its readyPattern (or stay up) before its timeout. Games needing a secret CI doesn't
+# have are skipped. Exits non-zero if any game failed.
+#   boot-test.sh palworld minecraft-crossplay
+set -uo pipefail
+
+AGENT_IMAGE="${AGENT_IMAGE:-www.gitea.gbreed.com/gbreed-public/gbr-node-agent:latest}"
+NETWORK=gbr-boottest
+
+if ! docker network inspect "$NETWORK" > /dev/null 2>&1; then
+  # Created by the runner setup with LAN access blocked; never fall back to an unisolated network
+  echo "::error::Docker network $NETWORK is missing on this runner; see RUNNER.md"
+  exit 1
+fi
+docker pull -q "$AGENT_IMAGE" > /dev/null
+
+# Built once: "go run" would turn the skip exit code (3) into a plain failure
+gbrgames="${RUNNER_TEMP:-/tmp}/gbrgames"
+go build -o "$gbrgames" ./cmd/gbrgames || exit 1
+
+passed=() failed=() skipped=()
+for id in "$@"; do
+  echo "::group::boot test: $id"
+  payload=$("$gbrgames" boottest-payload "$id")
+  code=$?
+  if [ $code -eq 3 ]; then
+    skipped+=("$id")
+    echo "::endgroup::"
+    continue
+  elif [ $code -ne 0 ]; then
+    failed+=("$id")
+    echo "::endgroup::"
+    continue
+  fi
+
+  docker run --rm -i \
+    -v /var/run/docker.sock:/var/run/docker.sock \
+    --entrypoint java "$AGENT_IMAGE" \
+    -Dloader.main=com.gbreed.gbr.nodeagent.BootTest -cp app.jar \
+    org.springframework.boot.loader.launch.PropertiesLauncher <<< "$payload"
+  if [ $? -eq 0 ]; then passed+=("$id"); else failed+=("$id"); fi
+  echo "::endgroup::"
+done
+
+echo "passed:  ${passed[*]:-none}"
+echo "skipped: ${skipped[*]:-none} (missing secrets)"
+echo "failed:  ${failed[*]:-none}"
+[ ${#failed[@]} -eq 0 ]