test: cli.sh reads fixtures, not the host it happens to run on

13 checks failed on any box with a Forgejo runner installed — which is
exactly a box that has been drilled or used as a ci-box. Unmodified main,
773/13 on this machine.

Seven bootstrap --undo checks fell through to the real host scan. The
production code already ships the escape hatch and documents it —
bootstrap-undo.sh:33, "RIG_FORGEJO_RUNNER_DIR mirrors RIG_RUNNER_DIR above so
tests can point this at a fixture" — and the suite simply never set it. One
check rebuilt its env by hand instead of using undo(), so it needed the same
variable a second time.

Six ci-box checks drove the real template installer, which correctly exits 0
when /usr/local/bin/forgejo-runner already exists. CIBOX_BIN is a test-only
override in the same spirit; the production default is untouched and remains
the only path the mechanism uses.

Neither guard is disarmed: driven for real, undo still refuses while a runner
exists, and the template installer still does nothing when the binary is
present. Removing either override brings its failures straight back (7 and 6).

Closes #136

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/templates/ci-box/install.sh

@@ -77,7 +77,12 @@ fetch_and_verify_sha256() {
   printf 'checksum verified (%s)\n' "$got"
 }
 
-BIN=/usr/local/bin/forgejo-runner
+# CIBOX_BIN is a TEST-ONLY override, in the same spirit as bootstrap-undo.sh's
+# RIG_FORGEJO_RUNNER_DIR: the production default is the only path the mechanism
+# ever uses, but test/cli.sh must be able to drive this script on a box that
+# already has a real runner installed. Without it the early-exit below fires
+# against the host and the checksum checks silently test nothing (#136).
+BIN="${CIBOX_BIN:-/usr/local/bin/forgejo-runner}"
 
 if [ -x "$BIN" ]; then
   exit 0

test/cli.sh

@@ -156,8 +156,9 @@ UNDO_FIX="$(mktemp -d)"
 UNDO_BIN="$UNDO_FIX/bin"
 UNDO_MARKER="$UNDO_FIX/role"
 UNDO_RUNNER="$UNDO_FIX/runner"
+UNDO_FJRUNNER="$UNDO_FIX/fjrunner"
 UNDO_CALLS="$UNDO_FIX/tailscale.calls"
-mkdir -p "$UNDO_BIN" "$UNDO_RUNNER"
+mkdir -p "$UNDO_BIN" "$UNDO_RUNNER" "$UNDO_FJRUNNER"
 cat > "$UNDO_BIN/tailscale" <<'SH'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >> "$UNDO_CALLS"
@@ -169,8 +170,13 @@ if [ "${1:-}" = -u ]; then printf '0\n'; else exec /usr/bin/id "$@"; fi
 SH
 chmod +x "$UNDO_BIN/tailscale" "$UNDO_BIN/id"
 undo() {
+  # RIG_FORGEJO_RUNNER_DIR is as load-bearing as RIG_RUNNER_DIR: without it
+  # bootstrap-undo.sh scans /home/*/forgejo-runner/.runner and the systemd unit
+  # on the REAL box, so these checks fail on any machine that has actually been
+  # drilled or used as a ci-box — which is the machine that matters (#136).
   env PATH="$UNDO_BIN:$PATH" UNDO_CALLS="$UNDO_CALLS" \
     RIG_ROLE_MARKER="$UNDO_MARKER" RIG_RUNNER_DIR="$UNDO_RUNNER" \
+    RIG_FORGEJO_RUNNER_DIR="$UNDO_FJRUNNER" \
     "$ROOT/bin/rig" bootstrap --undo
 }
 undo_untouched() {
@@ -196,7 +202,8 @@ rm -f "$UNDO_RUNNER/.runner"
 check "bootstrap --undo: failed logout is loud" \
   1 "role marker kept" env TAILSCALE_LOGOUT_FAIL=1 PATH="$UNDO_BIN:$PATH" \
     UNDO_CALLS="$UNDO_CALLS" RIG_ROLE_MARKER="$UNDO_MARKER" \
-    RIG_RUNNER_DIR="$UNDO_RUNNER" "$ROOT/bin/rig" bootstrap --undo
+    RIG_RUNNER_DIR="$UNDO_RUNNER" RIG_FORGEJO_RUNNER_DIR="$UNDO_FJRUNNER" \
+    "$ROOT/bin/rig" bootstrap --undo
 check "bootstrap --undo: failed logout preserves the marker" 0 "" test -e "$UNDO_MARKER"
 : > "$UNDO_CALLS"
 check "bootstrap --undo: proven rig join succeeds" 0 "tailnet join removed" undo
@@ -3276,7 +3283,9 @@ cibox_src_matches_install() {
   # shellcheck source=/dev/null
   . "$ROOT/commands/lib/templates.sh"
   template_parse_env "$dir/template.env" >/dev/null || return 2
-  grep -qF "BIN=$TPL_CLI_SRC" "$dir/install.sh"
+  # BIN carries a test-only override (#136), so the agreement this asserts is
+  # with the DEFAULT — the only path the mechanism itself ever uses.
+  grep -qF "CIBOX_BIN:-$TPL_CLI_SRC" "$dir/install.sh"
 }
 check "ci-box: CLI_SRC is the path its install.sh installs" 0 "" cibox_src_matches_install
 
@@ -3460,7 +3469,7 @@ chmod +x "$CBSTUB/install"
 
 cibox_run() { # cibox_run [VAR=val ...] — the REAL template install.sh, stubbed
   rm -f "$CBW/installed"
-  env PATH="$CBSTUB:$PATH" \
+  env PATH="$CBSTUB:$PATH" CIBOX_BIN="$CBW/bin-under-test" \
     CB_REDIRECT=https://code.forgejo.org/forgejo/runner/releases/tag/v9.9.9 \
     CB_PAYLOAD="$CBW/payload" "$@" bash "$CIBOX"
 }