fix(templates): the printed workload join follows rig's machine-role rename

The tenant half of rig#76 is what #123 tracked, but the machine half reaches
box in one place: the tailnet workload join box prints as the next step for a
staging-box guest is `rig bootstrap workload`, and that role is now
`workload-server`.

box never runs it -- it holds a pre-auth key, and that it stays operator-run
is the absence that keeps box creds-free end to end -- but box does PRINT it,
in three places that all had to move together: cmd_new's hint, the staging-box
seed's own comment, and the README. A next step an operator copy-pastes is as
wrong as a role box executes, and it fails later and further from the cause.

The suite's assertion moved with it, so it still pins what it was written to
pin: that the join is printed and never exec'd.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -49,6 +49,16 @@ which records not just what changed but what each drill run proved.
   re-homed legacy boxes `claude-box`, the name the template has today, so a
   re-homed box looks like a fresh mint rather than a fossil.
 
+  The **machine**-role half of rig's rename reaches box too, in one place:
+  the tailnet workload join box prints as a next step for a `staging-box`
+  guest is now `sudo rig bootstrap workload-server`. box never runs it — it
+  holds a pre-auth key, and that it stays operator-run is the absence
+  keeping box creds-free end to end — but box does *print* it, in three
+  places that all had to move together (`cmd_new`'s hint, the
+  `staging-box` seed's own comment, and the README). A next step an
+  operator copy-pastes is as wrong as a role box executes, and it fails
+  later and further from the cause.
+
 ## 0.8.0 — 2026-07-19
 
 ### Added

README.md

@@ -271,7 +271,7 @@ from rig's roles, instead of copy-pasted per template.
 
 **Anything that joins or admits stays operator-run.** The `staging-box`
 tenant's tailnet workload join holds a pre-auth key, so box only prints it as the
-next step — `box shell <name>`, then `sudo rig bootstrap workload` — and
+next step — `box shell <name>`, then `sudo rig bootstrap workload-server` — and
 never sees the key ([#69](https://github.com/heavy-duty/box/issues/69)'s
 split, kept).
 

bin/box

@@ -1201,7 +1201,7 @@ cmd_new() {
     echo "box: ready — 'box shell $name'. Log into Claude inside: run 'claude' then /login."
   elif [ "$eff" = staging-box ] || [ "$eff" = staging ]; then
     echo "box: ready — 'box shell $name'. The tailnet join stays operator-run (it holds a key box must never see):"
-    echo "  box shell $name    # then: sudo rig bootstrap workload --hostname $name"
+    echo "  box shell $name    # then: sudo rig bootstrap workload-server --hostname $name"
   else
     echo "box: ready — 'box shell $name'."
   fi

templates/staging-box/box.env

@@ -8,7 +8,7 @@
 # rig for a role that no longer exists. Server-CLASS, not a fleet machine:
 # this is still a box tenant, so it takes '-box', not '-server'. The tailnet
 # workload join holds a key and therefore STAYS operator-run:
-#   box shell <name>   # then: sudo rig bootstrap workload --hostname <name>
+#   box shell <name>   # then: sudo rig bootstrap workload-server --hostname <name>
 # KEY="value" only. Parsed against an allowlist, never sourced; there is no
 # key for a network or a security flag, on purpose — the shared box-net
 # profile is the placement contract and no template can weaken it.

templates/staging-box/user-data.yaml

@@ -4,7 +4,7 @@
 # no sshd config, no keys. The server posture comes from
 # 'rig bootstrap staging-box' (heavy-duty/rig#31), which box auto-runs after
 # mint; the tailnet workload join holds a pre-auth key and stays
-# operator-run ('box shell' → 'sudo rig bootstrap workload'), exactly as
+# operator-run ('box shell' → 'sudo rig bootstrap workload-server'), exactly as
 # #69 designed it — box never sees the key.
 users:
   - name: ops

test/cli.sh

@@ -432,11 +432,11 @@ check "new: the overran-but-registered branch says so (not the wedge story)" 0 "
 # shellcheck disable=SC2016  # the $-strings are literals in the target file
 check "new: BOX_LAUNCH_TIMEOUT is documented in box help new" 0 "" bash -c '
   "'"$ROOT"'/bin/box" help new | grep "BOX_LAUNCH_TIMEOUT" | grep -q 600'
-# staging's creds-holding join stays OPERATOR-run: cmd_new may print it as a
-# next step, but no template and no code path auto-runs "rig bootstrap
-# workload" — the one absence that keeps box creds-free end to end.
+# staging-box's creds-holding join stays OPERATOR-run: cmd_new may print it as
+# a next step, but no template and no code path auto-runs "rig bootstrap
+# workload-server" — the one absence that keeps box creds-free end to end.
 check "new: the workload join is printed, never exec'd" 1 "" bash -c '
-  grep "rig bootstrap workload" "'"$ROOT"'/bin/box" | grep -q "incus exec"'
+  grep "rig bootstrap workload-server" "'"$ROOT"'/bin/box" | grep -q "incus exec"'
 check "templates: no template names a creds-holding role" 1 "" bash -c '
   grep -h "^BOX_BOOTSTRAP_ROLE=" "'"$ROOT"'"/templates/*/box.env | grep -qE "workload|host|custom"'