ci: boot-test changed games before publishing

Only games whose folder changed are boot-tested (against the previous
main commit, or against main on branches; manual runs pick games). Each
one is deployed by the node-agent's real deploy code on a dedicated
game-test runner, in a network that can reach the internet but not the
LAN. Publishing to the panel runs only if they all booted.

- boottest-payload builds the DEPLOY_SERVER message the panel would send
- readyPattern/failPatterns in game.yaml; readyExample in test.yaml is
  checked against the pattern during validation
- secrets in test.yaml come from CI; a game missing one is skipped
- Minecraft gets a ready pattern; Dragonwilds needs DRAGONWILDS_OWNER_ID
- RUNNER.md + scripts/runner: runner, isolated network, systemd unit

Also fixes newline values ("\n" separators/footers) that yaml.v3 wrote
as "" on import, which would have broken ARK and Dragonwilds config
files once synced, and adds a round-trip test for the importer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/runner/config.yaml

@@ -0,0 +1,10 @@
+runner:
+  # One boot test at a time: game servers are big, and tests must not fight over RAM
+  capacity: 1
+  timeout: 3h
+
+container:
+  # Empty = use the host's Docker and mount it into job containers, which the boot test needs
+  # to start the node-agent and game containers
+  docker_host: ""
+  force_pull: false

scripts/runner/docker-compose.yml

@@ -0,0 +1,17 @@
+# The game-test runner: a second act_runner next to the build runner, so long boot tests
+# (ARK installs take 20+ minutes) never hold up builds. One job at a time.
+services:
+  game-test-runner:
+    image: gitea/act_runner:0.6.1
+    container_name: gitea-game-test-runner
+    restart: unless-stopped
+    environment:
+      GITEA_INSTANCE_URL: https://www.gitea.gbreed.com
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN}
+      GITEA_RUNNER_NAME: game-test
+      GITEA_RUNNER_LABELS: game-test:docker://catthehacker/ubuntu:act-latest
+      CONFIG_FILE: /config.yaml
+    volumes:
+      - ./config.yaml:/config.yaml:ro
+      - ./data:/data
+      - /var/run/docker.sock:/var/run/docker.sock

scripts/runner/gbr-boottest-network.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Isolated Docker network for GBR game boot tests
+After=docker.service
+Requires=docker.service
+PartOf=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/opt/gbr-boottest/setup-boottest-network.sh
+
+[Install]
+WantedBy=docker.service

scripts/runner/setup-boottest-network.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Creates the gbr-boottest Docker network and blocks it from private networks, so boot-tested game
+# servers can download what they need from the internet but never reach the LAN or the host.
+# Safe to re-run; the systemd unit in this folder runs it after every Docker start.
+set -euo pipefail
+
+NETWORK=gbr-boottest
+SUBNET=172.30.99.0/24
+
+if ! docker network inspect "$NETWORK" > /dev/null 2>&1; then
+  docker network create --driver bridge --subnet "$SUBNET" \
+    -o com.docker.network.bridge.name=br-gbrboot "$NETWORK"
+fi
+
+# DOCKER-USER is evaluated before Docker's own forwarding rules. Rebuild our rules from scratch.
+iptables -N GBR-BOOTTEST 2>/dev/null || iptables -F GBR-BOOTTEST
+iptables -C DOCKER-USER -s "$SUBNET" -j GBR-BOOTTEST 2>/dev/null \
+  || iptables -I DOCKER-USER -s "$SUBNET" -j GBR-BOOTTEST
+
+# Replies to connections the container opened (downloads) are fine
+iptables -A GBR-BOOTTEST -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+for net in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 169.254.0.0/16; do
+  iptables -A GBR-BOOTTEST -d "$net" -j DROP
+done
+iptables -A GBR-BOOTTEST -j RETURN
+
+# The host itself (SSH, the Docker API, anything listening) is reached via INPUT, not FORWARD
+iptables -C INPUT -i br-gbrboot -j DROP 2>/dev/null || iptables -I INPUT -i br-gbrboot -j DROP
+
+echo "gbr-boottest ready: $SUBNET, private networks and host blocked"