Configuration Hardening 2

What changed:

  - Added visible runtime override reporting with masking for sensitive values.
  - Expanded effective config for build cleanup, script compiler discovery/env, extract layout/cleanup/
    HAK discovery, wiki deploy defaults, autogen cache policy, and release-source env names.
  - Wired configured values into build, script compiler resolution, extract, autogen cache refresh/max
    age, parts manifest release source, wiki generation/deploy, and TLK output naming.
  - Added config sources override output and validation-rule hints in config explain.
  - Added CONFIGURATION_HARDENING_AUDIT.md.
  - Updated README.md with config commands, schema defaults, and JSON artifact boundaries.
  - Added regression tests for override visibility/masking, compiler/extract/wiki/autogen config,
    configured HAK discovery, and config sources output.

internal/topdata/tlk_native.go

@@ -356,7 +356,7 @@ func (c *tlkCompiler) allocateID() int {
 	return id
 }
 
-func (c *tlkCompiler) finish(outputDir string) (int, error) {
+func (c *tlkCompiler) finish(outputDir, tlkName string) (int, error) {
 	if err := os.MkdirAll(outputDir, 0o755); err != nil {
 		return 0, fmt.Errorf("create tlk output dir: %w", err)
 	}
@@ -388,7 +388,10 @@ func (c *tlkCompiler) finish(outputDir string) (int, error) {
 		entries[id] = c.active[key]
 	}
 
-	if err := writeTLKBinary(filepath.Join(outputDir, defaultTLKName), entries, c.language); err != nil {
+	if strings.TrimSpace(tlkName) == "" {
+		tlkName = defaultTLKName
+	}
+	if err := writeTLKBinary(filepath.Join(outputDir, tlkName), entries, c.language); err != nil {
 		return 0, err
 	}
 	if maxID < 0 {