test: move the end-to-end here, and fix the race that made it flaky

The e2e harness and its mock endpoint were living in the private repo, justified
by "they name the endpoint host". That was true when written and false two
commits later, once the hardcoded URL came out of the wrapper so the route would
live only in Bitwarden. Rechecked: all three name the endpoint zero times -- the
URL, username and password are supplied at runtime -- and the only host they
mention is this repo. They belong next to the dotup they exercise and the unit
suite that covers the rest of it.

The move surfaced a worse problem than the misplacement. The harness was flaky,
and an earlier PASS was partly luck.

chezmoi writes "git user.email?" with the tty still in cooked mode and only then
switches to raw mode -- with TCSAFLUSH, which discards whatever is already
buffered. Answering on the prompt TEXT races that switch. One run answered all
seven prompts; the next lost the Enter after user.email, leaving the field
unsubmitted. Every later expect then waited out its own timeout and the whole
thing surfaced at the 600s ceiling as an unattributed "a prompt went
unanswered".

Two fixes:

  - each answer now waits for \033[?2004h, bracketed-paste-on, which the TUI
    emits only AFTER raw mode is established. "Probably ready" becomes
    "demonstrably ready", and each prompt emits its own, so it is per-answer.
  - a bare `expect -re {pat} {...}` treats timeout as "carry on", which is what
    turned one lost keystroke into a ten-minute mystery. Prompts now fail
    immediately naming which one was missed, and distinguish EOF (dotup exited
    early) from timeout.

Also moved red(), the redactor, above the run. It was defined below the new
early-abort path that calls it, so the one branch that most needs redaction
would have hit an undefined function.

Verified by running it twice end to end against a mock endpoint, both passing
identically, including the three assertions the argv fix exists for.

README: the suite is 101 assertions, not 81, and the end-to-end is documented.

README.md

@@ -190,7 +190,7 @@ DOTUP_TEST_IMAGE=ubuntu:22.04 sh .tests/test.sh --docker
 DOTUP_TEST_IMAGE=debian:12    sh .tests/test.sh --docker
 ```
 
-81 assertions covering the toggle rule, the `@needs` closure both ways, the risk
+101 assertions covering the toggle rule, the `@needs` closure both ways, the risk
 model as invariants rather than prose, match confinement (two-sided: `--exact`
 confines `nvidia` to three rows **and** fuzzy still over-matches, so removing
 `--exact` fails loudly), the fzf preflight, channel resolution on both
@@ -209,6 +209,35 @@ for it. That is not theatre: it caught the apt/brew fallback running in both
 directions, which resolved Linux-only packages to `apt install davfs2` on a
 machine that has never had apt. The fallback is one-directional now.
 
+### End to end
+
+The suite above installs nothing. `.tests/e2e.sh` does the opposite — a stock
+`ubuntu:24.04` container, the public tier fetched from the anonymous URL, then
+the private tier through a real bootstrap endpoint, then `bws`, then a rendered
+`secrets.zsh`.
+
+```sh
+bash .tests/e2e.sh          # prompts for endpoint URL, username, password
+```
+
+The password is never written to disk and never placed on a command line: it
+reaches the container as `docker exec -e BOOT_PW` with a bare name, which
+inherits from the calling shell. `-e BOOT_PW=…` would put it in docker's own
+argv, and `/proc/<pid>/cmdline` is world-readable — the same bug this repo was
+fixed to stop committing itself.
+
+It asserts what the unit suite structurally cannot: that a machine which has
+only ever seen the public repo can authenticate, clone the private tier, and end
+up with **no credential in its logs and none in `.git/config`**, with the token
+in a 600-mode credential file that a later `fetch` still authenticates from.
+
+**Without an endpoint password**, `.tests/e2e-mock-endpoint.py` stands in for
+Caddy — 200 with the blob, 401 on bad credentials, and a closed connection on
+any other path, which is what `handle { abort }` does and why a retired route
+reports `000` rather than `404`. Everything downstream stays real. That is how
+the argv fix was verified, and running it that way immediately caught a rotation
+script whose route regex had stopped matching.
+
 ## Rules this repo lives by
 
 - **Zero credentials, forever.** `gitleaks detect` runs over the full history