fix(motd): repair legacy 00_lxc-details.sh header and dead color placeholders

[BadFlo]

Summary

Two related bugs in update_motd_ip() (ui/validate.func), both in containers built before motd_ssh started baking ${APPLICATION} in statically:

1. Broken header text. The legacy header re-derived the app name on every login by grepping /usr/bin/update's own text for whatever followed /ct/, assuming a literal URL. Once migrate_update_entrypoint() rewrites that URL to be built from $UPDATE_SCRIPT_NAME instead of a literal name, the literal text following /ct/ in the file becomes the placeholder itself, so the header renders as ${UPDATE_SCRIPT_NAME} LXC Container verbatim, forever (this file is only ever patched, never regenerated).
2. Dead color placeholders. The OS/Hostname/IP refresh writes values wrapped in ${GN}/${CL}, but those are only ever defined transiently inside the installer/updater's own process (the color() helpers in core.func/vm-core.func/incus/core.func) - never exported into the container's persistent environment. Confirmed empty even in a real pty-backed login shell. Worse, the "already up to date?" check only compares the value text, so once a line shows the right value it looks current forever and the dead placeholder never gets a chance to self-heal.

Fix

• Detect the legacy header block (signature: still contains APPL_NAME) and collapse it into a static line using the name migrate_update_entrypoint already resolved, reusing the same raw \033[1m/\033[m bytes the original line had (not a variable, since those don't reliably resolve).
• Detect a dead ${GN} placeholder on the OS/Hostname/IP lines and force a rewrite to raw \033[1;92m/\033[m bytes, independent of whether the value itself needs updating.

Two commits, one per bug, each with the full root-cause writeup in the commit message.

Test plan

• bash -n on the patched file
• shellcheck: zero new warnings vs. the pre-patch baseline (diffed both, only line-number shifts)
• shfmt -d: no formatting diff introduced by this change
• Reproduced both bugs and verified the fix against a real pty-rendered login session (script -qec 'bash -li -c ...'), before/after byte-for-byte diffs
• Applied and verified live on containers across two Proxmox VE cluster nodes, multiple independently-installed apps (different install vintages), confirming both the header text and OS/Hostname/IP now render correctly (matching sibling containers that never had this bug)
• Incus's own update_motd_ip() (incus/tools.func) never wrote this file at all, so it isn't affected and isn't touched here

[github-actions]

Try this branch

The engine and the scripts resolve independently, so a production script can
be run against the engine from this PR by setting one variable:

COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/BadFlo/core/fix-legacy-motd-header-after-migrate \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/debian.sh)"

Swap ct/debian.sh for whatever exercises the change.

Run a script from a fork as well

curl -fsSL https://raw.githubusercontent.com/BadFlo/core/fix-legacy-motd-header-after-migrate/tools/run.sh |
  bash -s -- https://raw.githubusercontent.com/YOU/ProxmoxVED/your-branch ct/debian.sh \
             https://raw.githubusercontent.com/BadFlo/core/fix-legacy-motd-header-after-migrate

Note that run.sh is reached through a pipe, so the script it starts inherits
an exhausted stdin. Whiptail is fine — it opens /dev/tty — but a plain read
would see EOF. The single-variable form above does not have that problem.

Useful flags while testing

dev_mode=net logs every engine fetch with status and duration, which is the
quickest way to confirm the branch is really being used. dev_mode=keep stops a
failed build from deleting the container along with the evidence.

[MickLesk]

What is broken? Can you add examples? I deploy ~25-50 LXC per Day and i dont see any broken MOTD? (Screenshots with Example please)

[BadFlo]

Good question — worth being precise about when this actually shows up, because it won't appear on any freshly-deployed LXC, which is why it's easy to miss deploying 25-50/day.

Why fresh deploys never see it: current motd_ssh() bakes ${APPLICATION} into 00_lxc-details.sh as a literal value at install time - that's correct and static from day one. This only affects containers built before that convention existed, once they later run update and get migrated onto the new bootstrap entrypoint (write_update_entrypoint/migrate_update_entrypoint in core.func).

Concrete repro, verbatim from one of my own containers (a docker.sh-based LXC, months old):

Before the fix, the legacy header block is still present:

$ grep -A1 APPL_NAME /etc/profile.d/00_lxc-details.sh
APPL=${APPL_NAME:-$APPLICATION_NAME}
#APPL=${APPL:-$(cat $(which update) | grep -oP '(?<=/ct/)[^.]+')}

and /usr/bin/update has already been migrated to the new bootstrap format:

export UPDATE_SCRIPT_NAME="docker"
...
bash -c "$(curl -fsSL "${COMMUNITY_SCRIPTS_URL}/ct/${UPDATE_SCRIPT_NAME}.sh")"

Because the legacy header logic greps this file's own text for whatever follows /ct/ (assuming a literal URL like /ct/docker.sh), and that text is now literally ${UPDATE_SCRIPT_NAME} instead of docker, the console shows, verbatim:

${UPDATE_SCRIPT_NAME} LXC Container

instead of Docker LXC Container. It never self-heals because 00_lxc-details.sh is only ever patched (OS/Hostname/IP), never regenerated from scratch.

The color half of this PR has the same "invisible until you look" property: ${GN}/${CL} are only ever defined transiently inside the installer/updater's own process, never exported for a later login shell - confirmed empty in a real pty-backed session. Once a line's value happens to be current, the existing staleness check (which only compares the value text) stops touching it, so the dead color wrapper is never revisited either.

I reproduced this on 15 already-existing LXCs across two Proxmox VE nodes in my own homelab - different apps and install ages (plex, adguard x2, jeedom, qbittorrent, zoraxy, cloudflared x2, paperless-ngx, openobserve, rustdesk-server, pbs, apt-cacher-ng, docker, uptime-kuma) - applied this fix, and confirmed both the header and the color lines render correctly afterward, checked via a real pty-backed login session (script -qec 'bash -li -c ...') with byte-for-byte before/after diffs.

Some screenshots :

[MickLesk]

Clean up the comments first please, the review is hard, if 25+ Lines of 50 are comments. Tell your AI to minimize or minimize by yourself. Kill "useless" comments first

[BadFlo]

Trimmed - comments cut from ~40% of added lines to ~22%, kept only the one-liners needed to explain the non-obvious parts (why raw bytes instead of $YW/$CL, why the staleness check needs a force-rewrite). Full rationale stays in the commit messages/PR description instead of the diff. Force-pushed.

[BadFlo]

Both addressed in 17a16a1:

• Range guard: entry now requires both APPL_NAME and "LXC Container" to be present, so the sed never runs unless the range can actually close. Verified against a copy of your repro (header saying just "Container") - file now comes out byte-for-byte unchanged instead of truncated, and a normal legacy header still collapses correctly.
• Renamed broken_os/broken_hostname/broken_ip to dead_color_os/dead_color_hostname/dead_color_ip.

Left the ^ capitalization as-is per your note that it's probably fine - happy to add word-boundary handling too if you'd rather.