Configuration Hardening 2

What changed:

  - Added visible runtime override reporting with masking for sensitive values.
  - Expanded effective config for build cleanup, script compiler discovery/env, extract layout/cleanup/
    HAK discovery, wiki deploy defaults, autogen cache policy, and release-source env names.
  - Wired configured values into build, script compiler resolution, extract, autogen cache refresh/max
    age, parts manifest release source, wiki generation/deploy, and TLK output naming.
  - Added config sources override output and validation-rule hints in config explain.
  - Added CONFIGURATION_HARDENING_AUDIT.md.
  - Updated README.md with config commands, schema defaults, and JSON artifact boundaries.
  - Added regression tests for override visibility/masking, compiler/extract/wiki/autogen config,
    configured HAK discovery, and config sources output.

internal/pipeline/extract.go

@@ -57,7 +57,7 @@ func Extract(p *project.Project, files ...string) (ExtractResult, error) {
 		failures = append(failures, errs...)
 	}
 
-	hakPaths, err := filepath.Glob(filepath.Join(p.BuildDir(), "*.hak"))
+	hakPaths, err := extractHAKPaths(p)
 	if err != nil {
 		return result, fmt.Errorf("scan hak archives: %w", err)
 	}
@@ -88,9 +88,11 @@ func Extract(p *project.Project, files ...string) (ExtractResult, error) {
 		failures = append(failures, errs...)
 	}
 
-	removed, errs := cleanupStaleFiles(p, desired)
-	result.Removed = removed
-	failures = append(failures, errs...)
+	if p.EffectiveConfig().Extract.CleanupStale == nil || *p.EffectiveConfig().Extract.CleanupStale {
+		removed, errs := cleanupStaleFiles(p, desired)
+		result.Removed = removed
+		failures = append(failures, errs...)
+	}
 
 	if len(failures) > 0 {
 		return result, errors.Join(failures...)
@@ -157,7 +159,7 @@ func extractedFile(p *project.Project, resource erf.Resource, extension string)
 
 	switch extension {
 	case "nss":
-		return filepath.Join(p.SourceDir(), "scripts", resref+".nss"), resource.Data, nil
+		return filepath.Join(p.ScriptSourceDir(), resref+".nss"), resource.Data, nil
 	case "utc", "utd", "ute", "uti", "utm", "utp", "uts", "utt", "utw",
 		"are", "dlg", "fac", "gic", "git", "ifo", "itp", "jrl":
 		document, err := gff.Read(bytes.NewReader(resource.Data))
@@ -175,6 +177,30 @@ func extractedFile(p *project.Project, resource erf.Resource, extension string)
 	}
 }
 
+func extractHAKPaths(p *project.Project) ([]string, error) {
+	switch p.EffectiveConfig().Extract.HAKDiscovery {
+	case "configured_haks":
+		paths := make([]string, 0, len(p.Config.HAKs))
+		for _, hak := range p.Config.HAKs {
+			path := p.HAKArchivePath(hak.Name)
+			if _, err := os.Stat(path); err == nil {
+				paths = append(paths, path)
+			} else if err != nil && !errors.Is(err, os.ErrNotExist) {
+				return nil, err
+			}
+		}
+		slices.Sort(paths)
+		return paths, nil
+	default:
+		hakPaths, err := filepath.Glob(filepath.Join(p.BuildDir(), "*.hak"))
+		if err != nil {
+			return nil, err
+		}
+		slices.Sort(hakPaths)
+		return hakPaths, nil
+	}
+}
+
 type writeState int
 
 const (