install.sh: reruns mutate the environment file promised immutable

[sweetcornna]

What happened

The upgrade guide promises that /etc/dormice/env is never touched once it exists, and the installer itself prints [skip] exists — kept as is. Immediately afterward, however, a rerun appends DORMICE_INGRESS_FILE=/etc/caddy/Caddyfile whenever Caddy is ready and that variable is absent.

Reproduction on a disposable host:

1. Create an existing /etc/dormice/env without DORMICE_INGRESS_FILE and record its checksum.
2. Make Caddy available/running so the installer sets INGRESS_FILE_READY.
3. Rerun deploy/install.sh.
4. Compare the file and its checksum.

Expected: An existing environment file remains byte-for-byte unchanged, as documented. An operator who intentionally omitted DORMICE_INGRESS_FILE remains in unmanaged-proxy mode.

Actual: The installer appends a comment and DORMICE_INGRESS_FILE=/etc/caddy/Caddyfile to the existing file.

Impact: A routine upgrade silently changes an operator's explicit ingress-management mode and breaks the documented configuration-preservation guarantee.

Relevant code and contract:

• deploy/install.sh:596-626 preserves an existing environment file in the main configuration branch.
• deploy/install.sh:627-635 then mutates that same file.
• website/content/docs/upgrading.mdx:30-35 promises the file is never touched once it exists.
• website/content/docs/doctor.mdx:99-107 documents an unset DORMICE_INGRESS_FILE as unmanaged-proxy mode.

dor doctor output

Not applicable: the failure is the installer's mutation of persistent configuration, before Doctor's result can restore the prior mode.

Environment

• Dormice commit: 4417ae14938273f5d937c476cf7cdc57e22e53a5
• Install mode: rerun with a pre-existing /etc/dormice/env
• Precondition: Caddy ready and DORMICE_INGRESS_FILE intentionally absent
• Verification: source-path trace and checksum-based reproduction