fix: the public tier names no real host (SEC-1)

The e2e script hardcoded the live Gitea hostname as the public tier's clone
URL. This repo is world-readable, so that published the host, and the same
host serves the secret-protected bootstrap route.

It now comes in as E2E_PUBLIC_URL, prompted for by the wrapper alongside the
bootstrap URL and passed to the container the same way. The lab already did
this with PUB_URL; this is the live path catching up. The :? form means an
unset variable aborts at that line with a message, rather than surfacing
later as an unattributable clone failure.

.tests/e2e.sh

@@ -50,6 +50,15 @@ IFS= read -r BOOT_URL
 BOOT_URL=${BOOT_URL%/}
 BOOT_URL=${BOOT_URL%/bootstrap.env}
 
+# Same reasoning for the public repo's own clone URL: it names the real Gitea
+# host, and this tier is public, so it is prompted for rather than committed.
+# Set E2E_PUBLIC_URL in your environment to skip the prompt.
+if [ -z "${E2E_PUBLIC_URL:-}" ]; then
+	printf 'Public repo clone URL: ' >&2
+	IFS= read -r E2E_PUBLIC_URL
+fi
+[ -n "$E2E_PUBLIC_URL" ] || { echo "no public repo URL given"; exit 1; }
+
 printf 'Username [ben]: ' >&2
 IFS= read -r BOOT_USER
 BOOT_USER=${BOOT_USER:-ben}
@@ -57,7 +66,7 @@ BOOT_USER=${BOOT_USER:-ben}
 printf 'Password: ' >&2
 IFS= read -rs BOOT_PW; printf '\n' >&2
 [ -n "$BOOT_PW" ] || { echo "empty password"; exit 1; }
-export BOOT_URL BOOT_USER BOOT_PW
+export BOOT_URL BOOT_USER BOOT_PW E2E_PUBLIC_URL
 
 # ---- fail fast: do not spend ten minutes to discover a typo ------------------
 # curl -K - reads credentials from stdin rather than argv.
@@ -78,7 +87,7 @@ docker run -d --name "$C" ubuntu:24.04 sleep infinity >/dev/null || exit 1
 docker cp "$INNER" "$C":/root/e2e.sh >/dev/null || exit 1
 
 # -e with a bare NAME inherits from this shell. Never NAME=value.
-docker exec -e BOOT_URL -e BOOT_USER -e BOOT_PW "$C" bash /root/e2e.sh
+docker exec -e BOOT_URL -e BOOT_USER -e BOOT_PW -e E2E_PUBLIC_URL "$C" bash /root/e2e.sh
 rc=$?
 
 echo