feat(docker): guide clone installation and validate paired update artifacts

src/lib/docker-install.test.ts

@@ -146,3 +146,51 @@ it("hands a completed installation to the existing updater", () => {
 	expect(result.output).toContain("Update invoked");
 	expect(result.profile).toContain("MODE=prebuilt");
 });
+
+it("defaults a new clone to source without requiring registry access", () => {
+	const result = configure(
+		"https://hotel.example\n\n",
+		"AUTH_SECRET=existing\n",
+	);
+	expect(result.status, result.output).toBe(0);
+	expect(result.profile).toContain("MODE=source");
+});
+it("keeps a saved prebuilt choice when the operator accepts defaults", () => {
+	const result = configure(
+		"\n\n",
+		"AUTH_SECRET=existing\n",
+		"MODE=prebuilt\nPUBLIC_URL=https://hotel.example\n",
+	);
+	expect(result.status, result.output).toBe(0);
+	expect(result.profile).toContain("MODE=prebuilt");
+});
+
+it("preflight treats dotenv as configuration data instead of executing host commands", () => {
+	const dir = mkdtempSync(join(tmpdir(), "cms-preflight-test-"));
+	try {
+		mkdirSync(join(dir, "scripts"));
+		copyFileSync(
+			resolve(root, "scripts/docker-preflight.sh"),
+			join(dir, "scripts/docker-preflight.sh"),
+		);
+		writeFileSync(join(dir, ".env"), "touch injected\n");
+		const result = spawnSync(bash, [join(dir, "scripts/docker-preflight.sh")], {
+			cwd: dir,
+			encoding: "utf8",
+			timeout: 15000,
+			env: {
+				...process.env,
+				ENV_FILE: join(dir, ".env"),
+				MYSQL_PORT: "1",
+				REDIS_PORT: "1",
+				CMS_PORT: "1",
+				BASH_ENV: resolve(root, "src/test/docker-install-harness.sh"),
+			},
+		});
+		if (result.error) throw result.error;
+		expect(existsSync(join(dir, "injected"))).toBe(false);
+		expect(result.stdout).toContain("Dotenv is not executed");
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});