Install opens up COMFY_DIR for the sandboxed service: ACL grant on Windows, BindPaths on Linux

internal/service/envfile.go

@@ -45,3 +45,19 @@ func writeEnvFile(path, content string) error {
 	}
 	return nil
 }
+
+// configuredValue reads one key from the env file the service will load, so
+// the installers can adapt the sandbox to it (ACL grants, unit directives).
+// "" when unset or unreadable.
+func configuredValue(configPath, key string) string {
+	f, err := os.Open(configPath)
+	if err != nil {
+		return ""
+	}
+	defer f.Close()
+	values, err := config.ParseEnvFile(f)
+	if err != nil {
+		return ""
+	}
+	return values[key]
+}