Move repo, CI and the video worker over to the name Feuerwerk (#422)

Stage 3 of the rename. The repo now lives at meleki/feuerwerk, the
runners carry feuerwerk labels and the WSL distro on melektaus-atx is
called feuerwerk-ci. The code has to follow, or CI finds no runner and
the suite no longer picks the GPU path.

- ci.yml: workflow name feuerwerk, jobs on feuerwerk-ci (gate, stein2)
  and feuerwerk-wsl (suite, melektaus-atx).
- GAME_MAKER_* variables are now FEUERWERK_*. This includes
  FEUERWERK_BROWSER=wsl, which the runner config on melektaus-atx sets.
- The video worker runs as container feuerwerk-video with the image
  feuerwerk-video and works on /srv/feuerwerk.
- e2e.sh starts the unit feuerwerk-e2e, the CI image keeps its paths
  under the new name.
- README and repo links point to git.nockal.com/meleki/feuerwerk. The
  old URLs still redirect with 301.

Both runners keep their old labels until the first CI run with this
ci.yml is through. Then they go, together with the image tag
game-maker-ci:latest and GAME_MAKER_BROWSER in the atx config.

Tests:
- Gate on melektaus-atx through the renamed distro: CHECK EXIT 0,
  307 files, 4756 tests.
- e2e 60 on melektaus-atx: ALL PASSED, 20 checks. Renderer is the
  RTX 4070 through D3D12, so FEUERWERK_BROWSER reaches the GPU path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/lib/auth.mjs

@@ -2,7 +2,7 @@
  * Signing the check tools in. Since #177 every API route but `auth/*` needs a session, so every
  * seed, smoke and e2e run logs in first – as `e2e`, the account that owns the four test projects.
  *
- * The password is never in the repo: it comes from `GAME_MAKER_E2E_PASSWORD` or from
+ * The password is never in the repo: it comes from `FEUERWERK_E2E_PASSWORD` or from
  * `data/e2e-password.txt`, which is git-ignored and written once per server (CI writes its own).
  */
 import { readFile } from 'node:fs/promises';
@@ -23,26 +23,26 @@ const cookies = new Map();
 
 /** The password of the `e2e` account; the step that drives the sign-in screen types it in. */
 export async function e2ePassword() {
-  const fromEnv = process.env.GAME_MAKER_E2E_PASSWORD;
+  const fromEnv = process.env.FEUERWERK_E2E_PASSWORD;
   if (fromEnv) return fromEnv;
   try {
     return (await readFile(PASSWORD_FILE, 'utf8')).trim();
   } catch {
     throw new Error(
-      `no password for the "${E2E_USER}" account: set GAME_MAKER_E2E_PASSWORD or put it in ${PASSWORD_FILE}`,
+      `no password for the "${E2E_USER}" account: set FEUERWERK_E2E_PASSWORD or put it in ${PASSWORD_FILE}`,
     );
   }
 }
 
-/** The password of `e2e-admin`, from `GAME_MAKER_E2E_ADMIN_PASSWORD` or `data/e2e-admin-password.txt`. */
+/** The password of `e2e-admin`, from `FEUERWERK_E2E_ADMIN_PASSWORD` or `data/e2e-admin-password.txt`. */
 export async function e2eAdminPassword() {
-  const fromEnv = process.env.GAME_MAKER_E2E_ADMIN_PASSWORD;
+  const fromEnv = process.env.FEUERWERK_E2E_ADMIN_PASSWORD;
   if (fromEnv) return fromEnv;
   try {
     return (await readFile(ADMIN_PASSWORD_FILE, 'utf8')).trim();
   } catch {
     throw new Error(
-      `no password for the "${E2E_ADMIN}" account: set GAME_MAKER_E2E_ADMIN_PASSWORD or put it in ${ADMIN_PASSWORD_FILE}`,
+      `no password for the "${E2E_ADMIN}" account: set FEUERWERK_E2E_ADMIN_PASSWORD or put it in ${ADMIN_PASSWORD_FILE}`,
     );
   }
 }

tools/lib/browser.mjs

@@ -30,7 +30,7 @@ const HEADLESS = [
 ];
 
 /**
- * GAME_MAKER_BROWSER=wsl, for a runner inside WSL2 (#283). There the GPU is /dev/dxg behind Mesa's
+ * FEUERWERK_BROWSER=wsl, for a runner inside WSL2 (#283). There the GPU is /dev/dxg behind Mesa's
  * d3d12 driver: no DRM render node, no Vulkan. Headless chromium finds no surface and gets no WebGL,
  * an X11 chromium on ANGLE/GL does. So this mode brings its own invisible X server.
  *
@@ -49,7 +49,7 @@ const WSL = [
 
 /** Starts chromium with the CDP port open; `proc.stderr` carries its last words. */
 export async function launchBrowser({ port, width, height }) {
-  const wsl = process.env.GAME_MAKER_BROWSER === 'wsl';
+  const wsl = process.env.FEUERWERK_BROWSER === 'wsl';
   const display = wsl ? await startXvfb({ width, height }) : null;
   const proc = spawn(
     'chromium',

tools/lib/projects.mjs

@@ -26,13 +26,13 @@ export const DEFAULT_BASE_URL = 'https://nockal.com/feuerwerk/';
 
 /**
  * Reads `[projectId] [baseUrl]` from argv, falling back to `defaultId` and to
- * `GAME_MAKER_BASE_URL` – which is how CI points every tool at its own server without
+ * `FEUERWERK_BASE_URL` – which is how CI points every tool at its own server without
  * repeating the project ids in shell scripts. Targeting the playground aborts: no tool may
  * overwrite or mutate it.
  */
 export function cliArgs(script, defaultId) {
   const projectId = process.argv[2] ?? defaultId;
-  const baseUrl = process.argv[3] ?? process.env.GAME_MAKER_BASE_URL ?? DEFAULT_BASE_URL;
+  const baseUrl = process.argv[3] ?? process.env.FEUERWERK_BASE_URL ?? DEFAULT_BASE_URL;
   if (projectId === PROJECTS.playground) {
     console.error(`refusing to run ${script} against the playground project (${PROJECTS.playground}).`);
     process.exit(2);