fix(celld): configure desktop snapshot outside runner secret

.github/workflows/celld-runner-deploy.yml

@@ -61,6 +61,8 @@ jobs:
       # fleet prefix: celld never reads it.
       DEPLOY_RECORD: s3://openwork-celld/ci/fleet-deployed.json
       RUNNER_VARS: ${{ secrets.CELLD_RUNNER_VARS }}
+      # Optional plain override so snapshot rotations don't require rewriting the secret JSON blob.
+      HEADLESS_COMPUTER_SNAPSHOT: ${{ vars.HEADLESS_COMPUTER_SNAPSHOT }}
       RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
       RENDER_OWNER_ID: tea-cspud29u0jms7384itk0
       RENDER_SERVICE_ID: srv-db3upfjbc2fs73c1ii70
@@ -116,6 +118,7 @@ jobs:
           computer="$(printf '%s' "$RUNNER_VARS" | jq -r '.HEADLESS_COMPUTER // ""')"
           desktop="$(printf '%s' "$RUNNER_VARS" | jq -r '.HEADLESS_COMPUTER_DESKTOP // ""')"
           snapshot="$(printf '%s' "$RUNNER_VARS" | jq -r '.HEADLESS_COMPUTER_SNAPSHOT // ""')"
+          if [ -n "${HEADLESS_COMPUTER_SNAPSHOT:-}" ]; then snapshot="$HEADLESS_COMPUTER_SNAPSHOT"; fi
           if [ "$computer" != "freestyle" ] || [ "$desktop" != "true" ]; then
             echo "No Freestyle desktop computers configured; nothing to check."
             exit 0
@@ -194,6 +197,12 @@ jobs:
           set -euo pipefail
           umask 077
           printf '%s' "$RUNNER_VARS" > "$RUNNER_TEMP/vars.json"
+          # Snapshot rotation is a plain environment variable; when unset, keep the secret's existing value.
+          if [ -n "${HEADLESS_COMPUTER_SNAPSHOT:-}" ]; then
+            jq --arg snapshot "$HEADLESS_COMPUTER_SNAPSHOT" '. + { HEADLESS_COMPUTER_SNAPSHOT: $snapshot }' \
+              "$RUNNER_TEMP/vars.json" > "$RUNNER_TEMP/vars.merged.json"
+            mv "$RUNNER_TEMP/vars.merged.json" "$RUNNER_TEMP/vars.json"
+          fi
           # Error reporting (opt-in): the DSN lives in its own secret so it can change without rewriting
           # CELLD_RUNNER_VARS. The version is the runner's source tree hash, not the commit, so an unchanged runner
           # still bundles to the same content hash and nodes don't re-adopt it.

docs/computer-use/workbot.md

@@ -116,7 +116,10 @@ HEADLESS_COMPUTER_DOMAIN=computers.example.com
 The production deploy (`celld-runner-deploy.yml`) stops before the fleet
 changes when the configured slug was built for a different guest, for example
 after a dependency bump changes a package the guest bundles. Build the new
-snapshot at that commit, update `CELLD_RUNNER_VARS`, then rerun the deploy.
+snapshot at that commit, set the `HEADLESS_COMPUTER_SNAPSHOT` variable in the
+`celld-production` GitHub environment, then rerun the deploy. This plain
+environment variable overrides the same field in `CELLD_RUNNER_VARS`; when it
+is unset, the JSON secret remains the fallback for existing setups.
 
 Keep `FREESTYLE_API_KEY` in the runner's secrets. Each desktop computer
 publishes only its viewer port, at a random host under that domain; the guest's

ee/apps/headless-runner/OWNER-CELLS.md

@@ -289,6 +289,9 @@ into it, and on demand (Actions → "Deploy runner to celld" → Run workflow).
   repository secrets), so nothing reaches them without that approval.
 - **`CELLD_DEPLOY_SLACK_WEBHOOK_URL`** (optional): an environment secret holding a Slack incoming-webhook URL for the
   channel that should hear about deploys. Without it the run posts nothing.
+- **`HEADLESS_COMPUTER_SNAPSHOT`** (optional): a plain environment variable holding the current Freestyle desktop
+  snapshot slug. It overrides this field in `CELLD_RUNNER_VARS`, so snapshot rotations don't require rewriting that
+  secret; when unset, the JSON value remains in effect.
 
 **Keep the default model authorized.** `CELLD_RUNNER_VARS` carries a provider route, key, model alias and protocol as
 one configuration. Before replacing a retired alias, list `/models` on the intended route with that same key and