ci: seed the validation .env from one script, not two copies

[Gerrrt]

The throwaway .env that gets compose.yaml's ${VAR:?} guards past
validation was built in two places: a run: block in ci.yml and a heredoc in
validate.sh. Both copied .env.example and appended the same variables, and
nothing tied them together.

They drifted the first time the list changed. 2431173 added the
RENDER_UID/RENDER_GID guards and updated only validate.sh, so it passed
locally and failed in CI:

error while interpolating services.alertmanager.user:
required variable RENDER_UID is missing a value: run make render

and needed a follow-up commit (165394c) to fix the copy that was missed.

scripts/seed-validation-env.sh is extracted and both callers invoke it, so the
list exists once. The script takes an output path; lifetime stays with the
caller, which is the only thing the two genuinely disagree about — CI wants the
gitignored stacks/observability/.env, validate.sh wants an mktemp file it
removes on a trap.

Sharing the script stops the two callers drifting from each other. It does not
stop both drifting from compose.yaml, so the script also asserts it covers
every ${VAR:?} it finds there — a newly guarded variable fails at seeding time
and names itself, rather than surfacing as an opaque interpolation error in
whichever caller runs first.

History

This commit was pushed to fix/rendered-secrets-container-uid after #15 was
merged, so it never had a PR of its own and was never merged. It surfaced during
a branch cleanup: its tip no longer matched the tip #15 recorded as merged, and
scripts/seed-validation-env.sh did not exist on main.

Rebased from 165394c onto 475126b. No conflicts, though main has since
touched both compose.yaml (b4da221) and validate.sh (c971366).

Verification

Run against the rebased tree:

• shellcheck scripts/*.sh — clean
• seeder writes all three guarded variables (GRAFANA_ADMIN_PASSWORD,
  RENDER_UID, RENDER_GID) plus the .env.example defaults
• docker compose --env-file <seeded> config -q — passes
• negative test: adding ${NEWLY_GUARDED_VAR:?} to compose.yaml makes the
  seeder exit 1 with
  compose.yaml guards NEWLY_GUARDED_VAR, which the validation .env does not set.
  (compose.yaml restored afterwards)
• ./scripts/validate.sh — all checks pass except gitleaks (full history),
  which fails only because the local gitleaks is 8.30.1 against CI's pinned
  8.24.0 and the .gitleaksignore fingerprints do not match across that gap.
  Pre-existing on main, unrelated to this branch.

🤖 Generated with Claude Code