fix: продакшен-фиксы install-flow и шаблонов

- исправлен рендер post-install.env: прокинут HYSTERIA_API_SECRET

- добавлен fail-fast при неразрешенных {{...}} в renderTemplate

- HY2XS_FORCE_PASSWORD_CHANGE приведён к production default=false

- docs синхронизированы: sudo bootstrap на deps-стадии

- builder: VERIFY_TOOLCHAIN_CHECKSUMS=true по умолчанию

- acceptance расширен новыми инвариантами

orchestrator/src/config/env.ts

@@ -208,7 +208,7 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
     adminUser: requireValue("HY2XS_ADMIN_USER", env.HY2XS_ADMIN_USER || "admin"),
     adminInitialPassword: valueOrGenerate(env.HY2XS_ADMIN_INITIAL_PASSWORD),
     adminConPass: requireValue("HY2XS_ADMIN_CON_PASS", valueOrGenerate(env.HY2XS_ADMIN_CON_PASS)),
-    forcePasswordChange: parseBool("HY2XS_FORCE_PASSWORD_CHANGE", env.HY2XS_FORCE_PASSWORD_CHANGE, true),
+    forcePasswordChange: parseBool("HY2XS_FORCE_PASSWORD_CHANGE", env.HY2XS_FORCE_PASSWORD_CHANGE, false),
     allowSelfSignedDev: parseBool("HY2XS_ALLOW_SELF_SIGNED_DEV", env.HY2XS_ALLOW_SELF_SIGNED_DEV, false),
     tlsMode,
     acmeType,

orchestrator/src/lib/fs.ts

@@ -87,5 +87,12 @@ export function renderTemplate(template: string, values: Record<string, string |
   for (const [key, value] of Object.entries(values)) {
     rendered = rendered.replaceAll(`{{${key}}}`, String(value));
   }
+
+  const unresolved = rendered.match(/\{\{\s*[A-Z0-9_]+\s*\}\}/g) ?? [];
+  if (unresolved.length > 0) {
+    const unique = [...new Set(unresolved.map((item) => item.replace(/\s+/g, "")))].sort();
+    throw new Error(`template render failed: unresolved placeholders: ${unique.join(", ")}`);
+  }
+
   return rendered;
 }

orchestrator/src/steps/env.ts

@@ -26,6 +26,7 @@ export async function writePostInstallEnv(context: RuntimeContext): Promise<void
     IGNORE_CLIENT_BANDWIDTH: context.config.hysteriaIgnoreClientBandwidth ? "true" : "false",
     HYSTERIA_API_HOST: context.config.hysteriaTrafficStatsHost,
     HYSTERIA_API_PORT: context.config.hysteriaTrafficStatsPort,
+    HYSTERIA_API_SECRET: context.config.hysteriaTrafficStatsSecret,
     UI_BIND_HOST: context.config.uiBindHost,
     UI_PORT: context.config.uiPort,
     INSTALL_DIR: context.config.installDir,