fix(boot-test): run every boot test with exactly what a new server gets

CI's boot test gave every blank password-like setting a throwaway value. A
real deploy only fills x-generate fields, so a template whose server won't
start without one passed CI and failed for the first owner who deployed it.

boottest-payload now fills only x-generate fields, for CI and the builder
alike. The old behaviour is kept as -fill-blank-passwords, used only by
the builder's second boot to tell whether an empty setting is why a draft
fails. Messages and AUTHORING.md no longer say boot tests fill passwords;
a server that needs a join password gets x-generate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/gbrgames/validate.go

@@ -168,8 +168,9 @@ func validateGame(dir, folder string, gameSchema, testSchema *jsonschema.Schema)
 			add("test.yaml config.%s is not a key of this game", key)
 		}
 		if sensitiveKey.MatchString(key) {
-			add("test.yaml config.%s looks like a credential; remove it (boot tests fill password settings with a throwaway "+
-				"value), or, only if the server can't start without a real one, map it under 'secrets' to a CI secret", key)
+			add("test.yaml config.%s looks like a credential; remove it. A new server starts without it, and the boot test "+
+				"does too: if the server can't, give the setting \"x-generate\" (a password per server). Map it under "+
+				"'secrets' to a CI secret only for a value that must be real (a license or account ID)", key)
 		}
 	}
 	for _, key := range sortedKeys(secrets) {