Fix seed env-knob forwarding; correct seeding and gce docs

Andrew Dunnrequested to merge
seeding-fixes-issue-2 into main

What

Fixes the three lab-validated findings in #2 (closed) plus two doc-accuracy items, in one MR. Closes #2 (closed).

Findings

  1. Env knobs dropped by run_seed_script (code). It embedded only ACCESS_TOKEN/GITLAB_URL into the gcloud ssh --command shell, which inherits nothing, so GPT_*/SEED_* knobs set in front of just seed were ignored. Now forwards a declared whitelist (SEED_ENV_KNOBS), printf %q-quoted and only when set.
  2. Tag-restricted bundled runner (doc). just duo-runner-register registers a gitlab--duo-tagged, run_untagged: false runner; untagged scan/CI jobs stay pending. Added a seeding.md caveat with the two ways to run untagged work. The general-purpose ci-runner-register recipe (the issue's other option) is being built and lab-validated as a separate follow-up MR.
  3. just ssh -- "..." quoting (doc). Documented in gce.md the variadic-quoting limitation and the simulator.sh ssh engine escape hatch.

Doc accuracy

  • Corrected the stale admin-PAT caveat: laptop state holds root_pat (not "only the password"); the VM-file PAT and laptop root_pat are distinct tokens, and just seed uses the laptop one.
  • Bumped the omnibus setup estimate from ~10-15 to ~15-25 min (SKILL.md + gce.md) to match observed provisioning.

Verification

  • No VM. The findings were lab-proven on a torn-down omnibus instance (repros in #2 (closed)). The fix logic is verified locally against the real run_seed_script with a stubbed harness across six cases (unset / set / multi / empty / spaced / non-whitelisted); the printf %q quoting confirmed to survive one remote-shell parse.
  • just ci clean; just sims-check green. SKILL.md's description is unchanged, so no fire-battery or fidelity re-run is required.

Merge request reports