fix: the public tier names no real host (SEC-1)

The e2e script hardcoded the live Gitea hostname as the public tier's clone
URL. This repo is world-readable, so that published the host, and the same
host serves the secret-protected bootstrap route.

It now comes in as E2E_PUBLIC_URL, prompted for by the wrapper alongside the
bootstrap URL and passed to the container the same way. The lab already did
this with PUB_URL; this is the live path catching up. The :? form means an
unset variable aborts at that line with a message, rather than surfacing
later as an unattributable clone failure.

.tests/e2e-private-tier.sh

@@ -3,7 +3,11 @@
 # anonymous URL, then the private tier through the real bootstrap endpoint.
 #
 # Credentials arrive in the environment (BOOT_URL/BOOT_USER/BOOT_PW) and are
-# never echoed. Package set is scoped to the private path and its dependency:
+# never echoed. The public clone URL arrives the same way, as E2E_PUBLIC_URL:
+# it names a real host, and this tier is world-readable, so it is passed in
+# rather than written down. `:?` means an unset variable aborts here with a
+# message, instead of the run failing later as an unattributable clone error.
+# Package set is scoped to the private path and its dependency:
 # the full manifest install is covered by the fake-package-manager suite, and
 # what has never run end to end is bootstrap -> bws -> private repo -> secrets.
 set -u
@@ -14,7 +18,8 @@ apt-get update -qq && apt-get install -y -qq git curl zsh ca-certificates expect
 
 # ---- 1. public tier, anonymously, exactly as a stranger would ---------------
 sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply \
-  "${E2E_PUBLIC_URL:?}" >/dev/null 2>&1 \
+  "${E2E_PUBLIC_URL:?set it to the anonymous clone URL of the public repo}" \
+  >/dev/null 2>&1 \
   || fail "public tier init"
 # Assert the ABSOLUTE path first, before touching PATH.
 #