Configuration Hardening 2

What changed:

  - Added visible runtime override reporting with masking for sensitive values.
  - Expanded effective config for build cleanup, script compiler discovery/env, extract layout/cleanup/
    HAK discovery, wiki deploy defaults, autogen cache policy, and release-source env names.
  - Wired configured values into build, script compiler resolution, extract, autogen cache refresh/max
    age, parts manifest release source, wiki generation/deploy, and TLK output naming.
  - Added config sources override output and validation-rule hints in config explain.
  - Added CONFIGURATION_HARDENING_AUDIT.md.
  - Updated README.md with config commands, schema defaults, and JSON artifact boundaries.
  - Added regression tests for override visibility/masking, compiler/extract/wiki/autogen config,
    configured HAK discovery, and config sources output.

README.md

@@ -65,6 +65,92 @@ music:
     envi/music/westgate: mus_wg_
 ```
 
+Resolved configuration can be inspected without scanning or building:
+
+```bash
+sow-toolkit config validate
+sow-toolkit config effective --json
+sow-toolkit config inspect paths.build
+sow-toolkit config explain topdata.package_hak
+sow-toolkit config sources
+```
+
+`config effective` prints the normalized values consumed by commands, including
+toolkit defaults, YAML values, legacy status, active environment overrides, and
+provenance. Sensitive override values such as tokens are reported as set without
+printing the secret.
+
+Common configurable defaults:
+
+```yaml
+paths:
+  source: src
+  assets: assets
+  build: build
+  cache: .cache
+  tools: tools
+
+outputs:
+  module_archive: "{module.resref}.mod"
+  hak_manifest: haks.json
+  hak_archive: "{hak.name}.hak"
+
+build:
+  keep_existing_haks: false
+
+inventory:
+  source_extensions: []      # empty means built-in NWN source extensions
+  asset_extensions: []       # empty means built-in NWN asset extensions
+  source_json_pattern: "{resref}.{extension}.json"
+
+scripts:
+  source_dir: scripts
+  cache: "{paths.cache}/ncs"
+  compiler:
+    path: ""
+    env:
+      path: SOW_NWN_SCRIPT_COMPILER
+      nwn_root: [SOW_NWN_ROOT, NWN_ROOT]
+      nwn_user_directory: [SOW_NWN_USER_DIRECTORY, NWN_HOME, NWN_USER_DIRECTORY]
+    search:
+      - "{paths.tools}/script-compiler/nwn_script_comp"
+      - "{paths.tools}/script-compiler/nwn_script_comp.exe"
+      - "{paths.tools}/nwn_script_comp"
+      - "{paths.tools}/nwn_script_comp.exe"
+      - PATH:nwn_script_comp
+
+extract:
+  layout: nwn_canonical_json
+  hak_discovery: build_glob      # or configured_haks
+  cleanup_stale: true
+  ignore_extensions: []
+  delete_module_archive_after_success: false
+
+topdata:
+  build: "{paths.build}/topdata"
+  compiled_2da_dir: 2da
+  compiled_tlk: sow_tlk.tlk
+  package_hak: sow_top.hak
+  package_tlk: sow_tlk.tlk
+  wiki:
+    output_root: wiki
+    pages_dir: pages
+    state_file: state.json
+    managed_namespaces: [classes, feat, itemtypes, races, skills, spells, meta]
+    deploy_manifest: .wiki_deploy_manifest.json
+    deploy_edit_summary: Auto-generated from native builder
+
+autogen:
+  cache:
+    root: "{paths.cache}"
+    max_age: 1h
+    refresh_env: SOW_AUTOGEN_MANIFEST_REFRESH
+  release_source:
+    provider: gitea
+    server_url_env: SOW_ASSETS_SERVER_URL
+    repo_env: SOW_ASSETS_REPO
+```
+
 Generated and machine-readable artifacts remain JSON, including HAK manifests,
 topdata datasets, caches, credits inventories, build reports, and canonical GFF
 documents. Nested metadata such as `topdata/templates/config.json` is not root
@@ -109,7 +195,8 @@ Consumer wrapper resolution is intentionally aligned:
 2. Else prefer a sibling `../sow-tools` checkout for local source development
 3. Else install the latest published `sow-tools` release artifact
 
-NWScript compilation behavior is also aligned:
+NWScript compilation behavior is also aligned and configurable under
+`scripts.compiler`:
 
 1. Prefer `SOW_NWN_SCRIPT_COMPILER` when explicitly set
 2. Else prefer a local compiler in `tools/script-compiler/` or `tools/`