test(multiplayer): lock allocated launch overrides

multiplayer-next.md

@@ -1400,3 +1400,5 @@ The NA overlay now also patches the allocated child’s `--region=NA` argument,
 Allocated Godot startup now derives its `min-players` floor from the verified signed roster size, preventing the direct-server default of one player from starting a partially admitted allocated match. A focused regression test covers six-player, casual two-player, and direct-server behavior; the full Godot harness is currently unavailable because Godot cannot open its shared `user://` log and crashes in the macOS renderer before test execution.
 
 The former display-name reclaim weakness (flagged item C) is now closed for allocated matches: the signed `PlayerID` is retained in the server roster and slot, and both reconnect reclaim and late-join promotion carry that stable identity across peer-id changes. Display-name matching remains only as a legacy fallback for unauthenticated direct servers. A focused adversarial unit test covers changed names, same-name impostors, missing identities, and the direct-server fallback.
+
+Allocated supervisor launch arguments now have a direct regression guard: authoritative match/server/image/assignment-expiry values replace stale child placeholders without mutating the caller’s command slice or disturbing unrelated arguments; dynamic Agones port propagation remains covered by the existing startup test. This closes the local implementation portion of task 8.29; live Agones passthrough/NAT and multi-match validation remain infrastructure gates.

server/supervisor/supervisor_test.go

@@ -13,6 +13,27 @@ import (
 	"time"
 )
 
+func TestWithAllocatedConfigOverridesAuthoritativeChildFlags(t *testing.T) {
+	command := []string{
+		"game-server", "--", "--allocated-mode", "--match-id=stale-match",
+		"--server-id=stale-server", "--server-image-digest=sha256:stale",
+		"--assignment-expiry-unix=1", "--region=EU", "--custom-flag=preserved",
+	}
+	expiry := time.Unix(1_900_000_000, 0).UTC()
+	got := withAllocatedConfig(command, "match-live", "server-live", "sha256:live", expiry)
+	want := []string{
+		"game-server", "--", "--allocated-mode", "--match-id=match-live",
+		"--server-id=server-live", "--server-image-digest=sha256:live",
+		"--assignment-expiry-unix=1900000000", "--region=EU", "--custom-flag=preserved",
+	}
+	if strings.Join(got, "\x00") != strings.Join(want, "\x00") {
+		t.Fatalf("allocated command = %#v, want %#v", got, want)
+	}
+	if strings.Join(command, "\x00") == strings.Join(got, "\x00") {
+		t.Fatal("withAllocatedConfig mutated the caller's command slice")
+	}
+}
+
 func TestAllocatedStartInjectsDynamicEndpointAndCallsReadyAfterProbe(t *testing.T) {
 	ready := false
 	readyCalled := false