Fix install-secrets.sh sentinel check for non-task invocation

PR #29's e2e workflow surfaced this: when invoked directly (not via
`task install`), the script silently no-ops and the stack comes up
with mariadb running on the literal CHANGE_ME password while
DATABASE_URL has the would-be-random hex. Doctrine: access denied,
exit code 1045.

Root cause: the sentinel check reads `$MARIADB_PASSWORD` from the env,
which is populated by Taskfile's `dotenv:` directive — but only when
the script runs as part of a `task` invocation. Direct invocation
(CI workflow, operator running from a fresh shell) leaves both
$MARIADB_PASSWORD and $MARIADB_ROOT_PASSWORD empty. The condition
"if NEITHER is CHANGE_ME, skip" then matches because both are "" —
not "CHANGE_ME" — and the script exits 0 without doing anything.

Fix: source .env.mariadb at the top of the script. Idempotent when
the env is already populated; load-bearing for direct invocation.
Same pattern env-init.sh uses for .env.

Verified: `env -i ./install-secrets.sh` (empty env) now correctly
detects the CHANGE_ME sentinel, generates random passwords, and
syncs DATABASE_URL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: turegjorup

scripts/install-secrets.sh

@@ -18,8 +18,19 @@ if [ ! -f .env.mariadb ] || [ ! -f .env.symfony ]; then
   exit 1
 fi
 
-# Sentinel detection via env vars (loaded by Taskfile's `dotenv:` directive).
-# If neither password is the CHANGE_ME placeholder, there's nothing to do.
+# Source .env.mariadb so $MARIADB_PASSWORD etc. are set whether the
+# script runs via `task install` (Taskfile's `dotenv:` already loaded it)
+# or stand-alone (CI workflow, manual invocation). Without this, an empty
+# env defeats the sentinel check below — both `${VAR:-}` evaluate to
+# empty (≠ "CHANGE_ME"), so the script silently exits 0 and mariadb
+# starts with the literal CHANGE_ME password from the file.
+set -a
+# shellcheck disable=SC1091
+. ./.env.mariadb
+set +a
+
+# Sentinel detection. If neither password is the CHANGE_ME placeholder,
+# there's nothing to do.
 if [ "${MARIADB_PASSWORD:-}" != "CHANGE_ME" ] && [ "${MARIADB_ROOT_PASSWORD:-}" != "CHANGE_ME" ]; then
   exit 0
 fi