fix(bootstrap): re-runs keep the operator's [registry] overrides

§15's upgrade path is "re-run the installer", but write_felis_toml rewrote the
[registry] table from scratch — url + build_namespace only. Everything else an
operator put there (the §8e build-lane executor mirrors, the resource caps, the
uploads backend stamped by the storage wizard, [registry.s3]) was silently
reverted on every re-run: builds went back to the denied upstream executors and
an S3-backed install flipped to local storage, with nothing pointing at why.

Found while landing the registry-hosting work, which depends on those same
keys surviving.

- persisted_registry_block carries the operator-owned [registry] keys and the
  [registry.s3] subtable forward, same first-readable-file rule as
  persisted_smtp_block; url/build_namespace stay installer-owned (they must
  match REGISTRY_URL/BUILD_NS, so a stale value must NOT survive).
- The s3 subtable header is re-emitted with its keys, so nothing carried lands
  as an unknown key under [registry].
- bootstrap_test.sh pins the carry, the installer-owned exclusion, and
  idempotence (a second re-run writes a byte-identical file).

deploy/bootstrap.sh

@@ -2129,17 +2129,50 @@ persisted_auth_source_blocks() {
     'url = "https://littleskin.cn/api/yggdrasil/sessionserver/session/minecraft/hasJoined"'
 }
 
+# persisted_registry_block echoes the operator-owned [registry] keys an earlier run
+# left behind — the build-lane executor mirrors, the resource caps, the uploads
+# backend and its [registry.s3] subtable — so §15's upgrade path (re-run the
+# installer) does not silently revert them. Nothing in this script's inputs
+# derives these: they are hand-written per docs/troubleshooting.md §8e or stamped
+# by the storage wizard. url and build_namespace are NOT carried: this script
+# owns them (they must match REGISTRY_URL / BUILD_NS). Same first-readable-file
+# rule as persisted_smtp_block.
+persisted_registry_block() {
+  local f out
+  for f in "${STATE_DIR}/felis.host.toml" "${STATE_DIR}/felis.pod.toml"; do
+    [ -r "$f" ] || continue
+    out="$(awk '
+      /^[[:space:]]*\[/ { sect = $0; next }
+      sect ~ /^[[:space:]]*\[registry\][[:space:]]*$/ &&
+        /^[[:space:]]*(kaniko_image|trivy_image|trivy_db_repository|build_cpu_limit|build_mem_limit|user_uploads_context)[[:space:]]*=/ { print }
+      sect ~ /^[[:space:]]*\[registry\.s3\][[:space:]]*$/ && /^[[:space:]]*[A-Za-z_]+[[:space:]]*=/ {
+        if (!s3hdr) { printf "[registry.s3]\n"; s3hdr = 1 }
+        print
+      }
+    ' "$f")"
+    [ -n "$out" ] || continue
+    printf '%s\n' "$out"
+    return 0
+  done
+}
+
 write_felis_toml() {
-  local target="$1" db_host="$2" smtp_block auth_source_blocks
+  local target="$1" db_host="$2" smtp_block auth_source_blocks registry_block
   smtp_block="$(persisted_smtp_block)"
   if [ -n "$smtp_block" ]; then
     log "carrying forward the configured [smtp] relay"
     smtp_block="${smtp_block}"$'\n' # keep a blank line before the next section
   fi
   auth_source_blocks="$(persisted_auth_source_blocks)"
+  registry_block="$(persisted_registry_block)"
+  if [ -n "$registry_block" ]; then
+    log "carrying forward the configured [registry] overrides"
+    registry_block="${registry_block}"$'\n' # keep a blank line before the next section
+  fi
   cat > "$target" <<EOF
 # Generated by deploy/bootstrap.sh; rerun the installer to regenerate. Hand edits are
-# overwritten, except [smtp] and [[auth_source]], which carry forward.
+# overwritten, except [smtp], [[auth_source]], and the operator-owned [registry]
+# overrides, which carry forward.
 [server]
 listen = "0.0.0.0:8080"
 root_domain = "${FELIS_ROOT_DOMAIN}"
@@ -2160,7 +2193,7 @@ lobby_image = "${FELIS_LOBBY_IMAGE}"
 [registry]
 url = "${REGISTRY_URL}"
 build_namespace = "${BUILD_NS}"
-
+${registry_block}
 [archive]
 store = "tarLocal"
 local_path = "${FELIS_ARCHIVE_LOCAL_PATH}"