Configuration Hardening

Key changes:

  - Added internal/project/effective.go with normalized effective config, defaults, provenance, and
    JSON output.
  - Added config subcommands:
      - config validate
      - config effective [--json|--yaml]
      - config inspect [<key>]
      - config explain <key>
      - config sources
  - Added YAML schema fields for configurable outputs, cache roots, script cache, inventory extensions,
    topdata output/wiki paths, and autogen cache root.
  - Routed existing hardcoded paths through effective config wrappers for module archives, HAK
    manifests/archives, script cache, music cache/credits, topdata outputs, and autogen caches.
  - Added validation for unsafe generated output/cache paths.
  - Updated command descriptions to avoid fixed build/, .cache, sow_top, etc.
  - Added regression tests for defaults, provenance, deterministic effective config, YAML-controlled
    derivation, config commands, and invalid paths.

internal/app/app_test.go

@@ -198,6 +198,94 @@ func TestRunBuildHAKsVerboseListsMappings(t *testing.T) {
 	}
 }
 
+func TestRunConfigEffectiveJSONShowsDefaultsAndProvenance(t *testing.T) {
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  source: src
+`)
+
+	var stdout bytes.Buffer
+	ctx := context{
+		stdout: &stdout,
+		stderr: &bytes.Buffer{},
+		cwd:    root,
+		args:   []string{"config", "effective", "--json"},
+	}
+
+	if err := runConfig(ctx); err != nil {
+		t.Fatalf("runConfig failed: %v", err)
+	}
+	output := stdout.String()
+	if !strings.Contains(output, `"hak_manifest": "haks.json"`) {
+		t.Fatalf("expected HAK manifest default in effective config, got %q", output)
+	}
+	if !strings.Contains(output, `"paths.build":`) || !strings.Contains(output, `"toolkit default"`) {
+		t.Fatalf("expected default provenance in effective config, got %q", output)
+	}
+}
+
+func TestRunConfigExplainReportsYAMLSource(t *testing.T) {
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  build: output
+`)
+
+	var stdout bytes.Buffer
+	ctx := context{
+		stdout: &stdout,
+		stderr: &bytes.Buffer{},
+		cwd:    root,
+		args:   []string{"config", "explain", "paths.build"},
+	}
+
+	if err := runConfig(ctx); err != nil {
+		t.Fatalf("runConfig failed: %v", err)
+	}
+	output := stdout.String()
+	if !strings.Contains(output, "value: \"output\"") {
+		t.Fatalf("expected configured build value, got %q", output)
+	}
+	if !strings.Contains(output, "source: yaml") {
+		t.Fatalf("expected YAML source, got %q", output)
+	}
+}
+
+func TestRunConfigValidateDoesNotScanSourceInventory(t *testing.T) {
+	root := t.TempDir()
+	mkdirAll(t, filepath.Join(root, "build"))
+	writeFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  source: missing-src
+  build: build
+`)
+
+	var stdout bytes.Buffer
+	ctx := context{
+		stdout: &stdout,
+		stderr: &bytes.Buffer{},
+		cwd:    root,
+		args:   []string{"config", "validate"},
+	}
+
+	if err := runConfig(ctx); err != nil {
+		t.Fatalf("runConfig failed: %v", err)
+	}
+	if !strings.Contains(stdout.String(), "config: ok") {
+		t.Fatalf("expected config validation output, got %q", stdout.String())
+	}
+}
+
 func mkdirAll(t *testing.T, path string) {
 	t.Helper()
 	if err := os.MkdirAll(path, 0o755); err != nil {