fix(multiplayer): align NA fleet region runtime

deploy/k8s/overlays/na/kustomization.yaml

@@ -4,3 +4,12 @@ resources:
   - ../../base
 patches:
   - path: region.yaml
+  - target:
+      group: agones.dev
+      version: v1
+      kind: Fleet
+      name: cosmic-clash-game
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/template/spec/containers/0/args/18
+        value: --region=NA

multiplayer-next.md

@@ -1394,3 +1394,5 @@ Bounded, but not by much: the attacker must race a genuine disconnect, and they
 #### Deployment wiring update (2026-09-01)
 
 The current working implementation now wires `deploy/k8s/base/fleet.yaml` to the digest-pinned `game-server` supervisor target, the in-cluster control-plane Service, workload roster materialization, signing/drain secret references, downward-API server/image identity, and the required game-server egress policy. `kubectl kustomize deploy/k8s/base` and `server/security/test_fleet_manifests.py` pass. The older 8.28 narrative above still records the pre-wiring state; live Agones, operator secret/image replacement, and real cluster readiness remain explicit gates.
+
+The NA overlay now also patches the allocated child’s `--region=NA` argument, keeping it aligned with the NA Fleet label; rendered EU and NA overlays and the adversarial manifest test verify that regional assignment validation cannot silently remain EU in the NA deployment.

server/security/test_fleet_manifests.py

@@ -60,8 +60,11 @@ class FleetManifestTest(unittest.TestCase):
     def test_eu_and_na_overlays_are_distinct_and_namespaced(self):
         eu = self.read("overlays/eu/region.yaml")
         na = self.read("overlays/na/region.yaml")
+        na_kustomization = self.read("overlays/na/kustomization.yaml")
         self.assertIn("cosmic-clash.io/region: EU", eu)
         self.assertIn("cosmic-clash.io/region: NA", na)
+        self.assertIn("path: /spec/template/spec/template/spec/containers/0/args/18", na_kustomization)
+        self.assertIn("value: --region=NA", na_kustomization)
         self.assertNotEqual(eu, na)
         for document in (eu, na):
             self.assertIn("namespace: cosmic-clash", document)