fix steam token getting reset

.forgejo/workflows/derive.yml

@@ -20,8 +20,9 @@ jobs:
     runs-on: s2-runner
     env:
       GAME: ${{ github.event.inputs.game }}
-      STEAM_APPS: /home/cs2/.steam/SteamApps
       STEAM_USER: source2rosetta
+      STEAM_HOME_ANON: /home/cs2
+      STEAM_HOME_AUTH: /home/cs2/steam-auth
       RELEASE_BASE: ${{ github.server_url }}/${{ github.repository }}/releases/download
       OVERRIDE_DIR: /home/cs2/rosetta-override
     steps:
@@ -30,12 +31,36 @@ jobs:
       - name: Update the install to the current build
         run: |
           case "$GAME" in
-            cs2)   APPID=730 ;;
-            dota2) APPID=570 ;;
+            cs2)   APPID=730; LOGIN=anonymous;      STEAM_HOME="$STEAM_HOME_ANON" ;;
+            dota2) APPID=570; LOGIN="$STEAM_USER";  STEAM_HOME="$STEAM_HOME_AUTH" ;;
             *) echo "unknown game '$GAME' (expected cs2 or dota2)"; exit 1 ;;
           esac
-          echo "APPID=$APPID" >> "$GITHUB_ENV"
-          steamcmd +login "$STEAM_USER" +app_update "$APPID" +quit
+          env HOME="$STEAM_HOME" steamcmd +login "$LOGIN" +app_update "$APPID" +quit
+
+          STEAM_APPS=""; SEEN=""; BUILD=""
+          for cand in "$STEAM_HOME/Steam/steamapps" "$STEAM_HOME/.steam/steam/steamapps" \
+                      "$STEAM_HOME/.steam/SteamApps"; do
+            m="$cand/appmanifest_$APPID.acf"
+            [ -f "$m" ] || continue
+            # The same tree reached twice through a symlink is ONE tree, not a disagreement.
+            key=$(stat -Lc '%d:%i' "$m")
+            case " $SEEN " in *" $key "*) continue ;; esac
+            SEEN="$SEEN $key"
+            b=$(grep -oP '"buildid"[[:space:]]+"\K[0-9]+' "$m")
+            echo "  candidate $cand -> buildid $b"
+            if [ -z "$STEAM_APPS" ]; then
+              STEAM_APPS="$cand"; BUILD="$b"
+            elif [ "$b" != "$BUILD" ]; then
+              echo "::error::two Steam app trees under $STEAM_HOME disagree — $STEAM_APPS says" \
+                   "$BUILD, $cand says $b. One is stale; deriving from it would publish gamedata for" \
+                   "a build nothing is running. Remove the stale tree or symlink it to the live one."
+              exit 1
+            fi
+          done
+          [ -n "$STEAM_APPS" ] || {
+            echo "::error::no appmanifest_$APPID.acf under $STEAM_HOME — did the update run?"; exit 1; }
+          echo "using $STEAM_APPS (buildid $BUILD)"
+          { echo "APPID=$APPID"; echo "STEAM_APPS=$STEAM_APPS"; } >> "$GITHUB_ENV"
 
       - name: Resolve the game paths + the new buildid
         run: |