Extraction Hardening

internal/app/app.go

@@ -1006,8 +1006,12 @@ func configValidationRules(key string) []string {
 		return []string{"generated output names must use the configured extension and must not escape the repository root"}
 	case key == "extract.layout":
 		return []string{"supported value: nwn_canonical_json"}
+	case key == "extract.archives":
+		return []string{"build-relative .mod/.hak glob patterns; .erf is intentionally rejected"}
+	case key == "extract.consume_archives":
+		return []string{"when true, selected build archives are deleted only after successful extraction"}
 	case key == "extract.hak_discovery":
-		return []string{"supported values: build_glob, configured_haks"}
+		return []string{"deprecated; use extract.archives instead"}
 	case key == "autogen.cache.max_age":
 		return []string{"Go duration string, for example 1h or 30m"}
 	case strings.HasPrefix(key, "topdata.package_hak"):