fix(alloy): make the copier's refusal case actually refuse

The engine-rejects test corrupted its own cfg file, but the copier always
renders from the repo config, so the gate validated a good file and
installed it; the test only surfaced where it was written, not where it
broke, because '!' suppresses errexit. Add an ALLOY_CONFIG_SRC seam
(alongside the *_CONF_ROOT seams) so the refusal case feeds the copier
the broken config it claims to test, and pin the repo-relative sed paths
to $REPO_ROOT — run.sh cds into tests/, so the relative path was dead
on any box that has the alloy image.

scripts/deploy-remote.sh

@@ -323,11 +323,13 @@ copy_alloy_config() {
     # The repo config carries the token GRAFANA_HOST_LABEL; the installed copy
     # carries the host's name, so Loki streams say WHICH machine's journal a
     # line came from without a second config file per host.
-    # *_CONF_ROOT are test seams: the bats cases execute these copiers for
-    # real against a sandbox with a stubbed run_privileged.
+    # *_CONF_ROOT and ALLOY_CONFIG_SRC are test seams: the bats cases execute
+    # these copiers for real against a sandbox with a stubbed run_privileged;
+    # ALLOY_CONFIG_SRC lets the refusal case feed a deliberately broken config.
     local root="${ALLOY_CONF_ROOT:-/opt/alloy}" tmp
+    local src="${ALLOY_CONFIG_SRC:-shared/alloy/config.alloy}"
     tmp="$(mktemp)"
-    sed "s/GRAFANA_HOST_LABEL/$TARGET/g" shared/alloy/config.alloy > "$tmp"
+    sed "s/GRAFANA_HOST_LABEL/$TARGET/g" "$src" > "$tmp"
     if ! grep -q "host = \"$TARGET\"," "$tmp" || grep -q "GRAFANA_HOST_LABEL" "$tmp"; then
         echo "alloy config: host-label substitution failed" >&2
         rm -f "$tmp"