[modem7]

What

The verify scripts no longer have modem7's values baked in. This is PR 2 of the series and is stacked on #52 (base branch mail-provider-neutral); merge #52 first and GitHub will retarget this to master.

verify-clone.sh:

• Finds shared.conf the same way the builder does (SHARED_CONF, BUILD_CONF, shared.conf next to the script) or takes --config <path>. Not found: it says so and verify-template.sh uses its built-in defaults, as before.
• Sources it in a subshell, unsets the secrets straight away, and passes only an allow-list of non-secret values to the guest as VERIFY_* variables via env. The mail password is never sent, printed or logged.
• Skips the "wait for status=sent" step for MAIL_RELAY=none, since mail stays local.

verify-template.sh:

• Reads the VERIFY_* values (explicitly empty means "off"; unset means the old default, so a hand run is unchanged).
• Mail checks follow MAIL_RELAY: gmail, custom (host, port, TLS by port, login or no login, optional MAIL_SENDER) and none (no relay, SASL or transport checks, no test mail). libsasl2-modules is expected only when a login is set.
• Unset or blank shell, needrestart, journal and unattended-upgrades mail settings are skipped instead of failing.

README updated. The branch also merges #52's TLS fix, so a login on any port expects encrypt.

Testing

bash -n and shellcheck are clean on all three scripts.

• Host side, against a mocked qm that logs every argument: no config, Gmail with old names, custom 465 with login, custom 25 with no login, none, sender set, --config, SHARED_CONF, BUILD_CONF, and error cases. The ansible key with spaces arrives as one argument. A marker password in the fake config appeared 0 times in the qm log, stdout and stderr.
• Guest side, against stub postconf, apt-config, dpkg-query, systemctl and others in a scratch directory: with nothing set, the old and new scripts give the same output and counts on good and broken fixtures. custom 465, custom 25 with no login, none, a sender and bad values behave as designed, and a wrong TLS level or SASL setting FAILs.

Not tested: a real qm guest exec and guest agent (that env plus its arguments pass through unchanged), a real Postfix (for example that postconf -h sender_canonical_classes prints exactly envelope_sender, header_sender), or a root run in a real clone. Please run ./verify-clone.sh <id> against a rebuilt template.

Note: sourcing shared.conf runs it as shell, the same as the builder does, so it needs to be a file you trust.