test(svc-net-tor): let the probe demand the values its test.env already sets

roles/svc-net-tor/templates/test.env.j2 sets RETRIES=6 and SLEEP_SECONDS=10, and
test-e2e-cli/tasks/run_one.yml renders that file unconditionally at :66 before
sourcing it at :74. The ${RETRIES:-20} / ${SLEEP_SECONDS:-15} fallbacks could
therefore never be reached -- a second source of truth that additionally
documented the wrong numbers: the header promised "default 20 / default 15"
while every run used 6 and 10.

They now take the :? form the two variables above them already use, so
test.env.j2 is the only place the values live, and a missing one aborts loudly
instead of silently probing three times longer than intended. The header stops
claiming defaults.

The sibling probes in svc-db-mariadb, svc-db-openldap and svc-db-postgres keep
${RETRIES:-20}: their test.env.j2 does not set the pair, so there the fallback is
live, not dead. Converting them would mean adding the values to those templates
first, and is deliberately left out.

Measured: a missing RETRIES exits 1 with "line 24: RETRIES: pass RETRIES as env
(attempts per domain, from svc-net-tor test.env)"; a complete env leaves the
probe output unchanged. shellcheck is clean against the staged content, and the
comment, shell and cli-asset-pairing lints pass.

The message wording avoids an apostrophe on purpose: inside ${VAR:?...} bash
still treats one as a quote character, which splits the abort message across the
next source line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/svc-net-tor/files/test/test.sh

@@ -10,20 +10,19 @@
 # (<servers>/{http,https}/<domain>.conf); pass explicit domains as arguments to
 # override.
 #
-# Env overrides:
-#   TOR_SOCKS         SOCKS proxy for .onion (required env; pass
-#                     127.0.0.1:<svc-net-tor services.tor.ports.local.socks>)
-#   NGINX_SERVERS_DIR vhost servers dir     (required env; the deployed
-#                     OpenResty servers dir from the nginx lookup)
-#   RETRIES           attempts per domain   (default 20)
-#   SLEEP_SECONDS     wait between attempts (default 15)
+# Env (all required; the role's test.env carries them):
+#   TOR_SOCKS         SOCKS proxy for .onion (127.0.0.1:<svc-net-tor
+#                     services.tor.ports.local.socks>)
+#   NGINX_SERVERS_DIR the deployed OpenResty servers dir from the nginx lookup
+#   RETRIES           attempts per domain
+#   SLEEP_SECONDS     wait between attempts
 
 set -uo pipefail
 
 TOR_SOCKS="${TOR_SOCKS:?pass TOR_SOCKS as env (127.0.0.1:<svc-net-tor services.tor.ports.local.socks>)}"
 NGINX_SERVERS_DIR="${NGINX_SERVERS_DIR:?pass NGINX_SERVERS_DIR as env (the deployed OpenResty vhost servers dir from the nginx lookup, e.g. /etc/nginx/conf.d/servers)}"
-RETRIES="${RETRIES:-20}"
-SLEEP_SECONDS="${SLEEP_SECONDS:-15}"
+RETRIES="${RETRIES:?pass RETRIES as env (attempts per domain, from svc-net-tor test.env)}"
+SLEEP_SECONDS="${SLEEP_SECONDS:?pass SLEEP_SECONDS as env (wait between attempts, from svc-net-tor test.env)}"
 
 discover_domains() {
 	find "${NGINX_SERVERS_DIR}/http" "${NGINX_SERVERS_DIR}/https" \