Configuration Hardening 2

What changed:

  - Added visible runtime override reporting with masking for sensitive values.
  - Expanded effective config for build cleanup, script compiler discovery/env, extract layout/cleanup/
    HAK discovery, wiki deploy defaults, autogen cache policy, and release-source env names.
  - Wired configured values into build, script compiler resolution, extract, autogen cache refresh/max
    age, parts manifest release source, wiki generation/deploy, and TLK output naming.
  - Added config sources override output and validation-rule hints in config explain.
  - Added CONFIGURATION_HARDENING_AUDIT.md.
  - Updated README.md with config commands, schema defaults, and JSON artifact boundaries.
  - Added regression tests for override visibility/masking, compiler/extract/wiki/autogen config,
    configured HAK discovery, and config sources output.

internal/topdata/wiki_deploy.go

@@ -20,16 +20,12 @@ import (
 )
 
 const (
-	defaultDeployManifestName = ".wiki_deploy_manifest.json"
-	defaultEditSummary        = "Auto-generated from native builder"
-	managedStartMarker        = "[//]: # (sow-topdata-wiki:managed:start)"
-	managedEndMarker          = "[//]: # (sow-topdata-wiki:managed:end)"
-	legacyManagedStartMarker  = "<!-- sow-topdata-wiki:managed:start -->"
-	legacyManagedEndMarker    = "<!-- sow-topdata-wiki:managed:end -->"
+	managedStartMarker       = "[//]: # (sow-topdata-wiki:managed:start)"
+	managedEndMarker         = "[//]: # (sow-topdata-wiki:managed:end)"
+	legacyManagedStartMarker = "<!-- sow-topdata-wiki:managed:start -->"
+	legacyManagedEndMarker   = "<!-- sow-topdata-wiki:managed:end -->"
 )
 
-var defaultManagedNamespaces = []string{"classes", "feat", "itemtypes", "races", "skills", "spells", "meta"}
-
 type DeployWikiOptions struct {
 	SourceDir      string
 	Endpoint       string
@@ -107,12 +103,12 @@ func DeployWikiWithOptions(p *project.Project, opts DeployWikiOptions, progress
 
 	namespaces := opts.Namespaces
 	if len(namespaces) == 0 {
-		namespaces = defaultManagedNamespaces
+		namespaces = p.EffectiveConfig().TopData.Wiki.ManagedNamespaces
 	}
 
 	manifestPath := opts.ManifestPath
 	if manifestPath == "" {
-		manifestPath = filepath.Join(filepath.Dir(opts.SourceDir), defaultDeployManifestName)
+		manifestPath = filepath.Join(filepath.Dir(opts.SourceDir), p.EffectiveConfig().TopData.Wiki.DeployManifest)
 	}
 
 	pages, err := collectLocalPages(opts.SourceDir, namespaces)
@@ -137,7 +133,7 @@ func DeployWikiWithOptions(p *project.Project, opts DeployWikiOptions, progress
 		return result, errors.New("remote managed wiki content drifted; rerun with --force to overwrite")
 	}
 
-	summary := defaultEditSummary
+	summary := p.EffectiveConfig().TopData.Wiki.DeployEditSummary
 	if opts.Version != "" {
 		summary = fmt.Sprintf("%s (%s)", summary, opts.Version)
 	}