feat(multiplayer): propagate allocated launch configuration

server/supervisor/supervisor_test.go

@@ -34,6 +34,36 @@ func TestWithAllocatedConfigOverridesAuthoritativeChildFlags(t *testing.T) {
 	}
 }
 
+func TestWithAllocatedCompatibilityOverridesStaleFlagsAndRejectsUnsafeValues(t *testing.T) {
+	command := []string{"game-server", "--region=EU", "--client-build=stale", "--protocol-version=1", "--transport=enet", "--custom=keep"}
+	gameServer := GameServer{}
+	gameServer.ObjectMeta.Annotations = map[string]string{
+		"cosmic-clash.io/region": "NA", "cosmic-clash.io/build": "build-live",
+		"cosmic-clash.io/protocol": "12", "cosmic-clash.io/transport": "steam_sdr",
+	}
+	got, err := withAllocatedCompatibility(command, gameServer)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"--region=NA", "--client-build=build-live", "--protocol-version=12", "--transport=steam_sdr", "--custom=keep"} {
+		found := false
+		for _, arg := range got {
+			if arg == want {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Fatalf("dynamic flag %q missing from %#v", want, got)
+		}
+	}
+	unsafe := gameServer
+	unsafe.ObjectMeta.Annotations = map[string]string{"cosmic-clash.io/region": "NA\nforged"}
+	if _, err := withAllocatedCompatibility(command, unsafe); err == nil {
+		t.Fatal("unsafe annotation did not fail closed")
+	}
+}
+
 func TestAllocatedStartInjectsDynamicEndpointAndCallsReadyAfterProbe(t *testing.T) {
 	ready := false
 	readyCalled := false