Configuration Hardening 2

What changed:

  - Added visible runtime override reporting with masking for sensitive values.
  - Expanded effective config for build cleanup, script compiler discovery/env, extract layout/cleanup/
    HAK discovery, wiki deploy defaults, autogen cache policy, and release-source env names.
  - Wired configured values into build, script compiler resolution, extract, autogen cache refresh/max
    age, parts manifest release source, wiki generation/deploy, and TLK output naming.
  - Added config sources override output and validation-rule hints in config explain.
  - Added CONFIGURATION_HARDENING_AUDIT.md.
  - Updated README.md with config commands, schema defaults, and JSON artifact boundaries.
  - Added regression tests for override visibility/masking, compiler/extract/wiki/autogen config,
    configured HAK discovery, and config sources output.

internal/topdata/parts_manifest.go

@@ -46,7 +46,7 @@ func resolveReleasedPartsManifest(p *project.Project, progress func(string)) (ma
 		progress = func(string) {}
 	}
 	cachePath := p.AutogenCachePath(partsManifestCacheFileName)
-	if strings.TrimSpace(os.Getenv("SOW_PARTS_MANIFEST_REFRESH")) == "" {
+	if strings.TrimSpace(os.Getenv(p.PartsManifestRefreshEnv())) == "" {
 		manifest, fresh, err := readFreshPartsManifestCache(cachePath, partsManifestCacheMaxAge)
 		if err != nil {
 			progress(fmt.Sprintf("Ignoring cached parts manifest: %v", err))
@@ -55,7 +55,7 @@ func resolveReleasedPartsManifest(p *project.Project, progress func(string)) (ma
 			return inventoryFromPartsManifest(manifest), nil
 		}
 	}
-	spec, err := deriveSowAssetsRepoSpec(p.Root)
+	spec, err := deriveSowAssetsRepoSpec(p)
 	if err != nil {
 		return nil, err
 	}
@@ -74,10 +74,10 @@ func resolveReleasedPartsManifest(p *project.Project, progress func(string)) (ma
 	return inventoryFromPartsManifest(manifest), nil
 }
 
-func deriveSowAssetsRepoSpec(root string) (giteaRepoSpec, error) {
-	serverOverride := strings.TrimSpace(os.Getenv("SOW_ASSETS_SERVER_URL"))
-	repoOverride := strings.TrimSpace(os.Getenv("SOW_ASSETS_REPO"))
-	remote, err := gitOutput(root, "remote", "get-url", "origin")
+func deriveSowAssetsRepoSpec(p *project.Project) (giteaRepoSpec, error) {
+	serverOverride := strings.TrimSpace(os.Getenv(p.AssetsServerURLEnv()))
+	repoOverride := strings.TrimSpace(os.Getenv(p.AssetsRepoEnv()))
+	remote, err := gitOutput(p.Root, "remote", "get-url", "origin")
 	spec := giteaRepoSpec{BaseURL: defaultGiteaBaseURL, Owner: defaultSowAssetsRepoOwner, Repo: defaultSowAssetsRepoName}
 	if err == nil && strings.TrimSpace(remote) != "" {
 		if derived, ok := parseRepoSpec(strings.TrimSpace(remote)); ok {