fix: продакшен-фиксы install-flow и шаблонов

- исправлен рендер post-install.env: прокинут HYSTERIA_API_SECRET

- добавлен fail-fast при неразрешенных {{...}} в renderTemplate

- HY2XS_FORCE_PASSWORD_CHANGE приведён к production default=false

- docs синхронизированы: sudo bootstrap на deps-стадии

- builder: VERIFY_TOOLCHAIN_CHECKSUMS=true по умолчанию

- acceptance расширен новыми инвариантами

tools/build/lib/acceptance.sh

@@ -15,6 +15,9 @@ run_fix20_acceptance_subset() {
   log_step "Acceptance: firewall mode defaults in config"
   grep -q '^HY2XS_FIREWALL_MODE=' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_FIREWALL_MODE missing in runtime config"
 
+  log_step "Acceptance: force password change production default"
+  grep -q '^HY2XS_FORCE_PASSWORD_CHANGE=false$' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_FORCE_PASSWORD_CHANGE must default to false"
+
   log_step "Acceptance: systemd unit production env"
   grep -q '^Environment=GIN_MODE=release$' "$package_dir/systemd/hy2xs-admin.service" || fail "acceptance: GIN_MODE=release missing"
 
@@ -28,4 +31,8 @@ run_fix20_acceptance_subset() {
   log_step "Acceptance: smoke auth checks are tokenized"
   grep -q 'unexpected auth status without machine token' orchestrator/src/steps/smoke.ts || fail "acceptance: missing 403 negative smoke for auth without machine token"
   grep -q 'hysteria2/auth?access_token=\${context.config.hysteriaTrafficStatsSecret}' orchestrator/src/steps/smoke.ts || fail "acceptance: smoke auth URL is not tokenized"
+
+  log_step "Acceptance: env rendering maps machine token and fails on unresolved placeholders"
+  grep -q 'HYSTERIA_API_SECRET: context.config.hysteriaTrafficStatsSecret' orchestrator/src/steps/env.ts || fail "acceptance: writePostInstallEnv must pass HYSTERIA_API_SECRET"
+  grep -q 'template render failed: unresolved placeholders' orchestrator/src/lib/fs.ts || fail "acceptance: renderTemplate must fail on unresolved placeholders"
 }