ci: boot-test changed games before publishing

Only games whose folder changed are boot-tested (against the previous
main commit, or against main on branches; manual runs pick games). Each
one is deployed by the node-agent's real deploy code on a dedicated
game-test runner, in a network that can reach the internet but not the
LAN. Publishing to the panel runs only if they all booted.

- boottest-payload builds the DEPLOY_SERVER message the panel would send
- readyPattern/failPatterns in game.yaml; readyExample in test.yaml is
  checked against the pattern during validation
- secrets in test.yaml come from CI; a game missing one is skipped
- Minecraft gets a ready pattern; Dragonwilds needs DRAGONWILDS_OWNER_ID
- RUNNER.md + scripts/runner: runner, isolated network, systemd unit

Also fixes newline values ("\n" separators/footers) that yaml.v3 wrote
as "" on import, which would have broken ARK and Dragonwilds config
files once synced, and adds a round-trip test for the importer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/runner/setup-boottest-network.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Creates the gbr-boottest Docker network and blocks it from private networks, so boot-tested game
+# servers can download what they need from the internet but never reach the LAN or the host.
+# Safe to re-run; the systemd unit in this folder runs it after every Docker start.
+set -euo pipefail
+
+NETWORK=gbr-boottest
+SUBNET=172.30.99.0/24
+
+if ! docker network inspect "$NETWORK" > /dev/null 2>&1; then
+  docker network create --driver bridge --subnet "$SUBNET" \
+    -o com.docker.network.bridge.name=br-gbrboot "$NETWORK"
+fi
+
+# DOCKER-USER is evaluated before Docker's own forwarding rules. Rebuild our rules from scratch.
+iptables -N GBR-BOOTTEST 2>/dev/null || iptables -F GBR-BOOTTEST
+iptables -C DOCKER-USER -s "$SUBNET" -j GBR-BOOTTEST 2>/dev/null \
+  || iptables -I DOCKER-USER -s "$SUBNET" -j GBR-BOOTTEST
+
+# Replies to connections the container opened (downloads) are fine
+iptables -A GBR-BOOTTEST -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+for net in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 169.254.0.0/16; do
+  iptables -A GBR-BOOTTEST -d "$net" -j DROP
+done
+iptables -A GBR-BOOTTEST -j RETURN
+
+# The host itself (SSH, the Docker API, anything listening) is reached via INPUT, not FORWARD
+iptables -C INPUT -i br-gbrboot -j DROP 2>/dev/null || iptables -I INPUT -i br-gbrboot -j DROP
+
+echo "gbr-boottest ready: $SUBNET, private networks and host blocked"