feat(builder): repair existing templates, a weekly check that queues repairs, and eval

The builder could only create games; nothing noticed when a live template
stopped working, and there was no way to tell whether a builder change made
it better or worse.

- repair -id ID: boots an existing template as nodes run it; if it fails,
  the same investigation as for a draft runs and the model changes only what
  the diagnosis says. The worker handles "repair" jobs (gameId from the
  panel) and opens "fix(games): repair ..." on draft/<id>; a template that
  boots as it is reports "nothing to repair" and opens no PR. The boot and
  fix loop is now shared by builds and repairs.
- validate.yml runs weekly and boot-tests every game; failed games are sent
  to the panel (X-GBR-Event: games_boot_failed) to queue repairs.
- eval -ids all: builds games that already have a template from scratch,
  blind, and scores each draft against it (boots, same image and app, ports,
  ready line, settings found) into eval.md and eval.json.
- research skips our own sites, so neither research nor eval reads our
  templates back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/validate.yml

@@ -5,6 +5,10 @@ name: Validate game templates
 # still checked through their push.
 on:
   push:
+  # Weekly: boot-test every game, so a template that stopped working (a game update, a changed image)
+  # is found before players are, and a repair is queued for the AI builder
+  schedule:
+    - cron: "0 6 * * 1"
   workflow_dispatch:
     inputs:
       games:
@@ -46,6 +50,8 @@ jobs:
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             games=$(scripts/changed-games.sh "${{ inputs.games }}")
+          elif [ "${{ github.event_name }}" = "schedule" ]; then
+            games=$(scripts/changed-games.sh all)
           elif [ "${{ github.ref }}" = "refs/heads/main" ]; then
             before="${{ github.event.before }}"
             if [ -z "$before" ] || ! git cat-file -e "$before" 2>/dev/null; then
@@ -78,10 +84,26 @@ jobs:
 
       # Secrets named in a game's test.yaml must be listed here to reach the boot test
       - name: Boot test changed games
+        id: boottest
         env:
           DRAGONWILDS_OWNER_ID: ${{ secrets.DRAGONWILDS_OWNER_ID }}
         run: scripts/boot-test.sh ${{ needs.validate.outputs.games }}
 
+      # The weekly run: each game that no longer boots gets a repair job in the panel; the AI builder takes
+      # it, and opens a pull request with the fix
+      - name: Queue repairs for games that stopped booting
+        if: failure() && github.event_name == 'schedule' && steps.boottest.outputs.failed != ''
+        env:
+          PANEL_WEBHOOK_SECRET: ${{ secrets.PANEL_WEBHOOK_SECRET }}
+        run: |
+          games=$(printf '"%s",' ${{ steps.boottest.outputs.failed }})
+          curl -sS --fail-with-body --max-time 30 --retry 3 --retry-delay 10 \
+            -X POST "${{ env.PANEL_WEBHOOK_URL }}" \
+            -H "Content-Type: application/json" \
+            -H "X-Gitea-Token: $PANEL_WEBHOOK_SECRET" \
+            -H "X-GBR-Event: games_boot_failed" \
+            -d "{\"games\":[${games%,}],\"run\":\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\"}"
+
   # main is the source of truth: send every template to the panel, which saves the changed ones
   # (new games arrive disabled). Runs only if the changed games booted, or none changed.
   publish: