fix(runtime): harden smoke and credential boundaries

runtime/entrypoint.sh

@@ -17,6 +17,34 @@ for key in POSTGRES_PASSWORD REDIS_PASSWORD GAME_TOKEN_SECRET KAKAO_REST_KEY KAK
   require_env "$key"
 done
 
+node /opt/sammo/validate-env.mjs
+
+git_auth_dir=/srv/data/git-auth
+mkdir -p "$git_auth_dir"
+umask 077
+
+if [ -n "${CORE_REPOSITORY_USERNAME:-}" ] || [ -n "${CORE_REPOSITORY_TOKEN:-}" ]; then
+  printf '%s' "$CORE_REPOSITORY_USERNAME" >"$git_auth_dir/https-username"
+  printf '%s' "$CORE_REPOSITORY_TOKEN" >"$git_auth_dir/https-token"
+  chmod 600 "$git_auth_dir/https-username" "$git_auth_dir/https-token"
+  export SAMMO_GIT_AUTH_DIR="$git_auth_dir"
+  export GIT_ASKPASS=/opt/sammo/git-askpass.sh
+  export GIT_TERMINAL_PROMPT=0
+  unset CORE_REPOSITORY_USERNAME CORE_REPOSITORY_TOKEN
+else
+  rm -f "$git_auth_dir/https-username" "$git_auth_dir/https-token"
+fi
+
+if [ -n "${CORE_SSH_PRIVATE_KEY_BASE64:-}" ] || [ -n "${CORE_SSH_KNOWN_HOSTS_BASE64:-}" ]; then
+  printf '%s' "$CORE_SSH_PRIVATE_KEY_BASE64" | base64 -d >"$git_auth_dir/id_deploy"
+  printf '%s' "$CORE_SSH_KNOWN_HOSTS_BASE64" | base64 -d >"$git_auth_dir/known_hosts"
+  chmod 600 "$git_auth_dir/id_deploy" "$git_auth_dir/known_hosts"
+  export GIT_SSH_COMMAND="ssh -i $git_auth_dir/id_deploy -o IdentitiesOnly=yes -o UserKnownHostsFile=$git_auth_dir/known_hosts -o StrictHostKeyChecking=yes"
+  unset CORE_SSH_PRIVATE_KEY_BASE64 CORE_SSH_KNOWN_HOSTS_BASE64
+else
+  rm -f "$git_auth_dir/id_deploy" "$git_auth_dir/known_hosts"
+fi
+
 case "${CORE_SOURCE_MODE:-clone}" in
   clone)
     require_env CORE_REPOSITORY_URL