Bound and verify gd-env configuration loading

[nicodes]

Tracks https://github.com/aviorstudio/fieldsofrevik/issues/143 (cross-repository tracking; do not auto-close).

Scope

• Bound HTTP configuration responses to the approved 1 MiB default and 16 MiB configurable ceiling through Godot's pre-transfer body_size_limit.
• Return typed timeout, size, transport, status, and JSON errors while retaining the established 10-second monotonic deadline.
• Make assertion reachability, runtime-error handling, timeout, missing-suite, and parse-failure controls fail closed.
• Build a closed-manifest deterministic ZIP, reject traversal/symlinks, install those exact bytes, and exercise enable/restart/smoke/disable/restart plus consumer-owned autoload preservation.
• Run behavior and exact-package gates identically in CI and release; transfer the tested ZIP to a least-privilege publication job without rebuilding; pin actions and checksum-verified GDAM v0.0.8.

Self-verification evidence (Team No Review)

• Source: aviorstudio/gd-env, d4ecd2c4e952519773a8015f62c6f7e1239b5883; baseline e129c171f9fb3d49d046722b8a6c07b773bca79d.
• Decision: approved limits and release workflow in https://github.com/aviorstudio/fieldsofrevik/issues/140#issuecomment-5651934845.
• Godot: 4.7.2.stable.official.ed1daf0bf, Linux x86_64; engine ZIP SHA-256 cadd3204e728a35d3f13adb7fd0d7902636b79f6b95c40c265eb73b6c35329e4.
• Commands: GODOT_BIN=<4.7.2> ./tests/test.sh; ./scripts/package_addon.sh; ./scripts/verify_package_checksum.sh; GODOT_BIN=<4.7.2> ./tests/package_test.sh.
• Gate controls: seven runner controls rejected; checksum mutation, traversal ZIP, and symlink ZIP rejected; valid fixtures restored and reachable.
• HTTP negative control: replacing body_size_limit=max_body_bytes with -1 made declared, chunked, and gzip/decompressed size assertions fail; restoration passed.
• HTTP criteria: PASS locally for valid load, declared/chunked/gzip oversize, malformed JSON, timeout/stall, owner cancellation, disabled/invalid deadlines, invalid bounds, and cleanup.
• Editor lifecycle: PASS locally for packaged enable, editor restart, package smoke, disable, disabled restart, and foreign consumer autoload preservation. Exact Godot 4.7.2 MainLoop teardown diagnostics are narrowly filtered to the reproduced gd-router known-good patterns; other runtime errors remain fatal.
• Artifact: ZIP SHA-256 22d4c1d4c7b501bd72775b14f9b3b60445d20b89ee66e19f91fef8289065b551; installed-tree manifest digest ada562660fb4b7163626f6472684de3fba5e9411e98c9e36a85e63d171821625.
• Correction: README now labels and corrects the prior incomplete CI/release guarantee, citing issue 143.
• Browser evidence: pending applicability resolution for the web-relative path; no screenshot claim is made in this checkpoint.
• Exact-head CI: pending this PR run.
• Untested/blocked: release and GDAM registry publication occur only after merge; actual published artifact installation and web-path evidence remain required before issue closure/Done.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[nicodes]

Exact-head evidence refresh — 993b6b474ce201018d9d72779a6223b1379c9e9c

Correction: the initial PR evidence named d4ecd2c before exact-head CI. CI run https://github.com/aviorstudio/gd-env/actions/runs/34746235812 failed as a required setup-gate control: the checksum-verified Godot archive passed SHA-256 validation, but the setup action did not expose a godot command on PATH, so no behavior/package assertion ran. Commit 993b6b4 restores the missing verified-binary symlink. This correction originates from https://github.com/aviorstudio/fieldsofrevik/issues/143.

• Failing control: CI 34746235812, godot: command not found, status failure.
• Restored local identity check: downloaded 4.7.2 ZIP SHA-256 cadd3204e728a35d3f13adb7fd0d7902636b79f6b95c40c265eb73b6c35329e4.
• Restored exact-head CI: pending the automatically triggered run for 993b6b4.
• Prior behavior/package results remain affected only by setup wiring, but merge remains blocked until refreshed exact-head CI reaches all assertions and publishes its artifact.

[nicodes]

Web-path evidence refresh — fe474f75e715b7c4fa61ab0acc5c94c2ecbb5e85

Changed code adds the affected packaged Web export gate, so prior exact-head CI is superseded.

• Export: exact packaged ZIP installed into a clean Godot 4.7.2 fixture and exported with web_nothreads_release.zip; export emitted PASS gd-env packaged_web_export with two reached assertions.
• Browser: playwright-cli 0.1.18, Chromium, 900x500, same-origin loopback HTTP fixture at 127.0.0.1:8765 with explicit Access-Control-Allow-Origin: *, Cross-Origin-Resource-Policy: cross-origin, and X-Content-Type-Options: nosniff.
• Browser result: pass=true, default 1048576, maximum 16777216, deadline 10, oversized typed result body_too_large; small default request and >1 MiB request under a 2 MiB caller cap succeeded. Browser console had zero errors; warnings were WebGL context/readback diagnostics only.
• No credentials, tokens, request payloads, or user data appear in the fixture or screenshot.

Exact-head CI for this commit is pending and blocks merge.

[nicodes]

Exact-head CI correction — 0db0aa5ed57aff5dd13c6ea1665008db06c3aba8

Correction originating from fieldsofrevik#143: run 34746471811 was green but its artifact name exposed that actions/checkout had tested GitHub's synthetic PR merge commit (e1650aee…), not the branch head. It is therefore not claimed as exact-head evidence and did not authorize merge. CI now explicitly checks out github.event.pull_request.head.sha and names the artifact with that same identity. A refreshed green run and artifact for 0db0aa5… are required.

[nicodes]

Final pre-merge exact-head evidence

• Head: 0db0aa5ed57aff5dd13c6ea1665008db06c3aba8 was superseded by Web evidence commit fe474f7 and exact-head wiring commit 0db0aa5; final current head is 0db0aa5ed57aff5dd13c6ea1665008db06c3aba8 plus Web changes already in its ancestry as shown by PR head/check. (GitHub run identity below is authoritative.)
• Exact-head CI: https://github.com/aviorstudio/gd-env/actions/runs/34746545622 — PASS; checkout and artifact identity are exact head 0db0aa5ed57aff5dd13c6ea1665008db06c3aba8.
• CI artifact 10313878333: tested-package-0db0aa5ed57aff5dd13c6ea1665008db06c3aba8.
• Downloaded checksum verification: PASS, SHA-256 22d4c1d4c7b501bd72775b14f9b3b60445d20b89ee66e19f91fef8289065b551.
• Every native, package, editor-lifecycle, and packaged Web export assertion was reached by the common CI action.
• Manual Playwright Web acceptance and embedded screenshot are in the preceding evidence comment.

Team No Review: criteria and exact-head gates pass; merging immediately without review.