Hardening audit

Key hardening changes:

  - Config validation now rejects paths.source: . and paths.assets: ., so source/asset roots cannot
    resolve to the repository root.
  - apply-hak-manifest now refuses to run when paths.source is unset or unsafe, instead of potentially
    writing under a root-level module/.
  - Inline flags across utility parsers now reject empty values consistently, e.g. --dataset=, --hak=,
    --endpoint=, --output=.
  - build-changelog now supports --flag=value inline syntax like the other utilities.

internal/pipeline/pipeline_test.go

@@ -548,6 +548,43 @@ func TestExtractKeepsConsumedModuleArchiveWhenExtractionFails(t *testing.T) {
 	}
 }
 
+func TestApplyHAKManifestRefusesUnsetSourcePath(t *testing.T) {
+	root := t.TempDir()
+	mustMkdir(t, filepath.Join(root, "assets"))
+	mustMkdir(t, filepath.Join(root, "build"))
+	mustMkdir(t, filepath.Join(root, "module"))
+	mustWriteFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  assets: assets
+  build: build
+`)
+	mustWriteFile(t, filepath.Join(root, "build", "haks.json"), `{"module_haks":["core"],"haks":[]}`)
+	mustWriteFile(t, filepath.Join(root, "module", "module.ifo.json"), "{}\n")
+
+	p, err := project.Load(root)
+	if err != nil {
+		t.Fatalf("load project: %v", err)
+	}
+
+	_, err = ApplyHAKManifest(p, filepath.Join(root, "build", "haks.json"))
+	if err == nil {
+		t.Fatal("expected apply manifest to fail")
+	}
+	if !strings.Contains(err.Error(), "paths.source is not configured") {
+		t.Fatalf("expected missing source path error, got %v", err)
+	}
+	raw, readErr := os.ReadFile(filepath.Join(root, "module", "module.ifo.json"))
+	if readErr != nil {
+		t.Fatalf("read root module file: %v", readErr)
+	}
+	if string(raw) != "{}\n" {
+		t.Fatalf("expected root module file to remain unchanged, got %q", string(raw))
+	}
+}
+
 func TestBuildSplitsConfiguredHAKs(t *testing.T) {
 	root := t.TempDir()
 	mustMkdir(t, filepath.Join(root, "src"))