Configuration Hardening 2

What changed:

  - Added visible runtime override reporting with masking for sensitive values.
  - Expanded effective config for build cleanup, script compiler discovery/env, extract layout/cleanup/
    HAK discovery, wiki deploy defaults, autogen cache policy, and release-source env names.
  - Wired configured values into build, script compiler resolution, extract, autogen cache refresh/max
    age, parts manifest release source, wiki generation/deploy, and TLK output naming.
  - Added config sources override output and validation-rule hints in config explain.
  - Added CONFIGURATION_HARDENING_AUDIT.md.
  - Updated README.md with config commands, schema defaults, and JSON artifact boundaries.
  - Added regression tests for override visibility/masking, compiler/extract/wiki/autogen config,
    configured HAK discovery, and config sources output.

internal/pipeline/pipeline_test.go

@@ -175,6 +175,77 @@ func TestExtractReadsHAKAssets(t *testing.T) {
 	}
 }
 
+func TestExtractConfiguredHAKDiscoveryIgnoresUnconfiguredArchives(t *testing.T) {
+	root := t.TempDir()
+	mustMkdir(t, filepath.Join(root, "src"))
+	mustMkdir(t, filepath.Join(root, "assets"))
+	mustMkdir(t, filepath.Join(root, "build"))
+
+	mustWriteFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  source: src
+  assets: assets
+  build: build
+extract:
+  hak_discovery: configured_haks
+haks:
+  - name: wanted
+    priority: 1
+    include:
+      - wanted/**
+`)
+
+	p, err := project.Load(root)
+	if err != nil {
+		t.Fatalf("load project: %v", err)
+	}
+	if err := p.ValidateLayout(); err != nil {
+		t.Fatalf("validate layout: %v", err)
+	}
+
+	modFile, err := os.Create(p.ModuleArchivePath())
+	if err != nil {
+		t.Fatalf("create mod: %v", err)
+	}
+	if err := erf.Write(modFile, erf.New("MOD ", nil)); err != nil {
+		t.Fatalf("write mod: %v", err)
+	}
+	if err := modFile.Close(); err != nil {
+		t.Fatalf("close mod: %v", err)
+	}
+	for _, name := range []string{"wanted", "ignored"} {
+		hakFile, err := os.Create(filepath.Join(root, "build", name+".hak"))
+		if err != nil {
+			t.Fatalf("create hak: %v", err)
+		}
+		if err := erf.Write(hakFile, erf.New("HAK ", []erf.Resource{
+			{Name: name + "_asset", Type: 0x07D2, Data: []byte("mdl-data")},
+		})); err != nil {
+			t.Fatalf("write hak: %v", err)
+		}
+		if err := hakFile.Close(); err != nil {
+			t.Fatalf("close hak: %v", err)
+		}
+	}
+
+	result, err := Extract(p)
+	if err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	if len(result.HAKPaths) != 1 || filepath.Base(result.HAKPaths[0]) != "wanted.hak" {
+		t.Fatalf("expected only configured hak, got %#v", result.HAKPaths)
+	}
+	if _, err := os.Stat(filepath.Join(root, "assets", "mdl", "wanted_asset.mdl")); err != nil {
+		t.Fatalf("expected wanted asset: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(root, "assets", "mdl", "ignored_asset.mdl")); !os.IsNotExist(err) {
+		t.Fatalf("expected ignored asset to remain absent, err=%v", err)
+	}
+}
+
 func TestExtractDeletesConsumedModuleArchiveAfterSuccessWhenConfigured(t *testing.T) {
 	root := t.TempDir()
 	mustMkdir(t, filepath.Join(root, "src", "module"))