ci: boot-test changed games before publishing

Only games whose folder changed are boot-tested (against the previous
main commit, or against main on branches; manual runs pick games). Each
one is deployed by the node-agent's real deploy code on a dedicated
game-test runner, in a network that can reach the internet but not the
LAN. Publishing to the panel runs only if they all booted.

- boottest-payload builds the DEPLOY_SERVER message the panel would send
- readyPattern/failPatterns in game.yaml; readyExample in test.yaml is
  checked against the pattern during validation
- secrets in test.yaml come from CI; a game missing one is skipped
- Minecraft gets a ready pattern; Dragonwilds needs DRAGONWILDS_OWNER_ID
- RUNNER.md + scripts/runner: runner, isolated network, systemd unit

Also fixes newline values ("\n" separators/footers) that yaml.v3 wrote
as "" on import, which would have broken ARK and Dragonwilds config
files once synced, and adds a round-trip test for the importer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/changed-games.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Prints the ids of games whose folder changed, one per line.
+#   changed-games.sh BASE_REF HEAD_REF   games changed between two commits
+#   changed-games.sh all                 every game
+#   changed-games.sh "palworld,ark-..."  just these
+set -euo pipefail
+
+if [ "${1:-}" = "all" ]; then
+  ls games
+  exit 0
+fi
+if [ $# -eq 1 ]; then
+  tr ',' '\n' <<< "$1" | sed 's/ //g' | grep -v '^$' | while read -r id; do
+    [ -d "games/$id" ] && echo "$id" || echo "unknown game: $id" >&2
+  done
+  exit 0
+fi
+
+git diff --name-only "$1" "$2" -- games/ \
+  | cut -d/ -f2 | sort -u \
+  | while read -r id; do
+      # A deleted game has nothing to boot
+      [ -f "games/$id/game.yaml" ] && echo "$id"
+    done || true