chore(demo): bootstrap fills an empty rig token in an existing .env

The first run wrote the .env but could not read RUSTLINK_WEB_TOKEN (the
demo subuser had no startup.read; it has now). On an existing .env the
bootstrap now fills DEMO_RIG_SIDECAR_TOKEN when it is empty and leaves
every other value alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

.gitea/workflows/demo-bootstrap.yml

@@ -52,10 +52,6 @@ jobs:
             sudo -n mkdir -p "$DEMO_DIR"
             sudo -n chown "$(id -u):$(id -g)" "$DEMO_DIR"
           fi
-          if test -f "$DEMO_DIR/.env"; then
-            echo "$DEMO_DIR/.env already exists; left untouched."
-            exit 0
-          fi
           echo "PTERODACTYL_CLIENT_KEY secret present: $(test -n "$PTERODACTYL_CLIENT_KEY" && echo yes || echo no)"
 
           # The rig's web token: the startup variable first, then sidecar.toml.
@@ -71,10 +67,25 @@ jobs:
           fi
 
           hex() { head -c "$1" /dev/urandom | od -An -tx1 | tr -d ' \n'; }
+          setkv() { K="$1" V="$2" awk 'index($0, ENVIRON["K"] "=") == 1 { $0 = ENVIRON["K"] "=" ENVIRON["V"] } { print }' "$f" > "$f.tmp"; cat "$f.tmp" > "$f"; rm -f "$f.tmp"; }
+
+          # An existing .env keeps every value; only an empty rig token is filled.
+          if test -f "$DEMO_DIR/.env"; then
+            f="$DEMO_DIR/.env"
+            if grep -q '^DEMO_RIG_SIDECAR_TOKEN=$' "$f" && test -n "$RIG_TOKEN"; then
+              setkv DEMO_RIG_SIDECAR_TOKEN "$RIG_TOKEN"
+              echo "$f exists; filled DEMO_RIG_SIDECAR_TOKEN only."
+            else
+              echo "$f exists; left untouched."
+            fi
+            echo "Empty keys left:"
+            grep -E '^[A-Z_]+=$' "$f" | cut -d= -f1 || true
+            exit 0
+          fi
+
           f="$DEMO_DIR/.env.new"
           cp deploy/demo/.env.example "$f"
           chmod 600 "$f"
-          setkv() { K="$1" V="$2" awk 'index($0, ENVIRON["K"] "=") == 1 { $0 = ENVIRON["K"] "=" ENVIRON["V"] } { print }' "$f" > "$f.tmp"; mv "$f.tmp" "$f"; }
           setkv DB_PASSWORD "$(hex 24)"
           setkv DB_ROOT_PASSWORD "$(hex 24)"
           setkv JWT_SECRET "$(hex 32)"