Fix review issues #62-#66 filed against the Avo installer (PR #52)

[kanejamison]

Summary

This PR fixes the five review issues filed against PR #52 (the bunko:avo:install Avo admin installer). It targets the set-up-an-avo-installer-rake branch so the fixes flow into that PR.

• Avo installer: ENV["EDITOR"] collides with the universal shell variable #62 — EDITOR env var collision: The installer now reads BUNKO_EDITOR instead of ENV["EDITOR"] (which collided with the universal shell $EDITOR, so EDITOR=vim silently fell through to the textarea branch). The value is validated against markdown/rhino/tiptap/trix/textarea and the task aborts with a message listing valid options on anything else. Task help output, README, and tests updated; new tests cover the invalid-value abort and that the shell $EDITOR is ignored.
• Avo installer: generated Ransack search lacks ransackable_attributes allowlist #63 — Ransack allowlist (security): The installer's next-steps output now prints a clearly worded post-install step with the explicit allowlist to add to app/models/post.rb: def self.ransackable_attributes(auth_object = nil) = %w[id title slug] — only id/title/slug, never status or content, since Avo search also runs over drafts. The generated resource template and the README document the same allowlist plus the behavior when ransack is absent from the bundle (add the gem or remove the search block).
• Avo installer: PostTypeFilter passes a record where by_post_type expects a name #64 — PostTypeFilter matched nothing: The generated filter passed a PostType record to Post.by_post_type, which expects a name string, so it silently matched nothing. It now uses query.where(post_type: post_type); the task test asserts the corrected query is generated.
• Avo installer: post-install message should warn users to lock down /avo #65 — Unauthenticated admin warning (security/docs): The install task's "Next steps" now includes an explicit numbered security step warning that the generated admin panel is wide open until Avo's authenticate_with/authorization is configured, linking to https://docs.avohq.io/3.0/authentication.html. The README's Avo section mirrors the warning.
• Avo installer: publish/unpublish actions ignore update failures #66 — Silent action failures: The generated PublishPost/UnpublishPost actions now check each update's return value, collect failures with record identifiers and error messages, and report through Avo's error/warn APIs — plain succeed only when everything succeeded, error when every record failed, and warn with succeeded/failed counts for mixed batches.

Two small housekeeping commits were also needed to make bundle exec rake green on this branch: a fix for an order-dependent assertion in the sample-data root-route test (the live dummy-app root route made root_route_exists? true depending on test order), and a Standard lint fix in the generated pages_controller.rb.tt template (single-quoted string).

Closes #62
Closes #63
Closes #64
Closes #65
Closes #66

Test results

• bundle exec rake (tests + standardrb): 374 runs, 1406 assertions, 0 failures, 0 errors, 1 skip (the skip is pre-existing); Standard lint clean.
• Suite run twice to confirm no order-dependence.

🤖 Generated with Claude Code

---

Generated by Claude Code