fix: the public tier names no real host (SEC-1)

The e2e script hardcoded the live Gitea hostname as the public tier's clone
URL. This repo is world-readable, so that published the host, and the same
host serves the secret-protected bootstrap route.

It now comes in as E2E_PUBLIC_URL, prompted for by the wrapper alongside the
bootstrap URL and passed to the container the same way. The lab already did
this with PUB_URL; this is the live path catching up. The :? form means an
unset variable aborts at that line with a message, rather than surfacing
later as an unattributable clone failure.

.tests/e2e-private-tier.sh

@@ -3,7 +3,11 @@
 # anonymous URL, then the private tier through the real bootstrap endpoint.
 #
 # Credentials arrive in the environment (BOOT_URL/BOOT_USER/BOOT_PW) and are
-# never echoed. Package set is scoped to the private path and its dependency:
+# never echoed. The public clone URL arrives the same way, as E2E_PUBLIC_URL:
+# it names a real host, and this tier is world-readable, so it is passed in
+# rather than written down. `:?` means an unset variable aborts here with a
+# message, instead of the run failing later as an unattributable clone error.
+# Package set is scoped to the private path and its dependency:
 # the full manifest install is covered by the fake-package-manager suite, and
 # what has never run end to end is bootstrap -> bws -> private repo -> secrets.
 set -u
@@ -14,7 +18,8 @@ apt-get update -qq && apt-get install -y -qq git curl zsh ca-certificates expect
 
 # ---- 1. public tier, anonymously, exactly as a stranger would ---------------
 sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply \
-  "${E2E_PUBLIC_URL:?}" >/dev/null 2>&1 \
+  "${E2E_PUBLIC_URL:?set it to the anonymous clone URL of the public repo}" \
+  >/dev/null 2>&1 \
   || fail "public tier init"
 # Assert the ABSOLUTE path first, before touching PATH.
 #

.tests/e2e.sh

@@ -50,6 +50,15 @@ IFS= read -r BOOT_URL
 BOOT_URL=${BOOT_URL%/}
 BOOT_URL=${BOOT_URL%/bootstrap.env}
 
+# Same reasoning for the public repo's own clone URL: it names the real Gitea
+# host, and this tier is public, so it is prompted for rather than committed.
+# Set E2E_PUBLIC_URL in your environment to skip the prompt.
+if [ -z "${E2E_PUBLIC_URL:-}" ]; then
+	printf 'Public repo clone URL: ' >&2
+	IFS= read -r E2E_PUBLIC_URL
+fi
+[ -n "$E2E_PUBLIC_URL" ] || { echo "no public repo URL given"; exit 1; }
+
 printf 'Username [ben]: ' >&2
 IFS= read -r BOOT_USER
 BOOT_USER=${BOOT_USER:-ben}
@@ -57,7 +66,7 @@ BOOT_USER=${BOOT_USER:-ben}
 printf 'Password: ' >&2
 IFS= read -rs BOOT_PW; printf '\n' >&2
 [ -n "$BOOT_PW" ] || { echo "empty password"; exit 1; }
-export BOOT_URL BOOT_USER BOOT_PW
+export BOOT_URL BOOT_USER BOOT_PW E2E_PUBLIC_URL
 
 # ---- fail fast: do not spend ten minutes to discover a typo ------------------
 # curl -K - reads credentials from stdin rather than argv.
@@ -78,7 +87,7 @@ docker run -d --name "$C" ubuntu:24.04 sleep infinity >/dev/null || exit 1
 docker cp "$INNER" "$C":/root/e2e.sh >/dev/null || exit 1
 
 # -e with a bare NAME inherits from this shell. Never NAME=value.
-docker exec -e BOOT_URL -e BOOT_USER -e BOOT_PW "$C" bash /root/e2e.sh
+docker exec -e BOOT_URL -e BOOT_USER -e BOOT_PW -e E2E_PUBLIC_URL "$C" bash /root/e2e.sh
 rc=$?
 
 echo