perf(web-app-discourse): read the applied settings back in the apply runner

The read-back booted Rails a second time (9.0 s on echoserver in full-8)
to check what the apply runner had just written. verify_settings.rb now
runs as the third script of the apply runner's `rails r` and registers
discourse_settings_readback for the unchanged refuse assert; every env var
and stdin line it needs is already a subset of the apply runner's.

It starts with SiteSetting.refresh!, which reloads the settings through
fetch_setting_hash_from_provider (Discourse v2026.9.1
lib/site_setting_extension.rb:595), so the check reads what the database
holds rather than the values the same process has just set;
User.find_by_email loads the administrator afresh. The formatter's wrap
of the `sh -c` line rides along; it parses to the same string.

On merge: feature/store-i18n 8c2f9c95c2 moves both runners' credentials
to `-e NAME` plus `environment:` and reads platform_administrator. Keep
that convention on the apply runner, drop the read-back runner as here,
and keep the third script and the register on the apply runner.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

roles/web-app-discourse/files/ruby/verify_settings.rb

@@ -1,6 +1,8 @@
 # nocheck: mirrored-unit-test - reads SiteSetting and User out of the booted
 # application, neither of which exists outside the Discourse console
 
+SiteSetting.refresh!
+
 email = ENV.fetch("DISCOURSE_ADMIN_EMAIL")
 password = ENV.fetch("DISCOURSE_ADMIN_PASSWORD")
 

roles/web-app-discourse/tasks/stack_host/02_credentials.yml

@@ -1,5 +1,5 @@
 ---
-- name: "⚙️ Apply the site settings and the current administrator password"
+- name: "⚙️ Apply and read back the site settings and the administrator password"
   ansible.builtin.command:
     argv:
       - container
@@ -26,39 +26,16 @@
       - "{{ DISCOURSE_CONTAINER }}" # nocheck: container-exec-resolver  the launcher names the container itself, so the bare name resolves in both modes
       - sh
       - -c
-      - 'IFS= read -r DISCOURSE_LDAP_SITE_SETTINGS; IFS= read -r DISCOURSE_OIDC_CLIENT_SECRET; IFS= read -r DISCOURSE_ADMIN_PASSWORD; export DISCOURSE_LDAP_SITE_SETTINGS DISCOURSE_OIDC_CLIENT_SECRET DISCOURSE_ADMIN_PASSWORD; exec "$@"'
+      - 'IFS= read -r DISCOURSE_LDAP_SITE_SETTINGS; IFS= read -r DISCOURSE_OIDC_CLIENT_SECRET; IFS= read -r DISCOURSE_ADMIN_PASSWORD; export DISCOURSE_LDAP_SITE_SETTINGS
+        DISCOURSE_OIDC_CLIENT_SECRET DISCOURSE_ADMIN_PASSWORD; exec "$@"'
       - sh
       - rails
       - r
-      - "{{ lookup('file', 'ruby/apply_settings.rb') }}\n{{ lookup('file', 'ruby/ensure_admin_user.rb') }}"
+      - "{{ lookup('file', 'ruby/apply_settings.rb') }}\n{{ lookup('file', 'ruby/ensure_admin_user.rb') }}\n{{ lookup('file', 'ruby/verify_settings.rb') }}"
     stdin: |-
       {{ (DISCOURSE_PLUGINS['discourse-ldap-auth'].config.site_settings if DISCOURSE_LDAP_ENABLED | bool else {}) | to_json }}
       {{ OIDC.CLIENT.SECRET if DISCOURSE_OIDC_ENABLED | bool else '' }}
       {{ lookup('users', 'administrator').password }}
-  changed_when: false
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-
-- name: "🔎 Read the applied settings back out of the running instance"
-  ansible.builtin.command:
-    argv:
-      - container
-      - exec
-      - -i
-      - -e
-      - "DISCOURSE_ADMIN_EMAIL={{ lookup('users', 'administrator').email }}"
-      - -e
-      - "DISCOURSE_OIDC_ENABLED={{ DISCOURSE_OIDC_ENABLED | bool | string | lower }}"
-      - "{{ DISCOURSE_CONTAINER }}" # nocheck: container-exec-resolver  the launcher names the container itself, so the bare name resolves in both modes
-      - sh
-      - -c
-      - 'IFS= read -r DISCOURSE_ADMIN_PASSWORD; IFS= read -r DISCOURSE_OIDC_CLIENT_SECRET; export DISCOURSE_ADMIN_PASSWORD DISCOURSE_OIDC_CLIENT_SECRET; exec "$@"'
-      - sh
-      - rails
-      - r
-      - "{{ lookup('file', 'ruby/verify_settings.rb') }}"
-    stdin: |-
-      {{ lookup('users', 'administrator').password }}
-      {{ OIDC.CLIENT.SECRET if DISCOURSE_OIDC_ENABLED | bool else '' }}
   register: discourse_settings_readback
   changed_when: false
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"