The payload builder filled anything matching the validator's broad credential pattern that wasn't a non-empty string, so RCON_PORT, ENABLE_RCON and ARK's RCONEnabled/RCONPort became 'boot-123456' in the first runner run. Only fill keys named like passwords (or x-generate), and only when missing or an empty string. Adds a test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>