fix(test): stream resource fault configuration through stdin

scripts/inbound-plan-resource-fault-runtime.test.mjs

@@ -4,8 +4,16 @@ import {spawnSync} from 'node:child_process';
 import {fileURLToPath} from 'node:url';
 const script=String.raw`
 import importlib.util,sys,json,hashlib,copy,urllib.error
+import io
 from pathlib import Path
 spec=importlib.util.spec_from_file_location('resource_runtime',sys.argv[1]);m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+payload={'scope':{'marker':'stdin'},'complete':'x'*200000}
+assert m.read_stdin_config(io.BytesIO(json.dumps(payload).encode()))==payload
+try:m.read_stdin_config(io.BytesIO(b'x'*(1024*1024+1)));raise AssertionError('unbounded config accepted')
+except RuntimeError as e:assert str(e)=='RUNTIME_STDIN_CONFIG_TOO_LARGE'
+try:m.read_stdin_config(io.BytesIO(b'{"private":"secret"'));raise AssertionError('partial JSON accepted')
+except json.JSONDecodeError as e:
+ d=m.safe_diagnostic(e);assert d['diagnostic']['stage']=='READ_STDIN_CONFIG';assert 'secret' not in json.dumps(d)
 m.STAGE='NACOS_SOURCE_READ'
 for endpoint,stage in [('/nacos/v3/auth/user/login','NACOS_LOGIN'),('/nacos/v3/admin/cs/config','NACOS_CONFIG_READ')]:
  d=m.safe_diagnostic(urllib.error.HTTPError('http://user:password@private.invalid'+endpoint+'?token=secret',404,'secret body',{},None))
@@ -59,6 +67,16 @@ for key,value in [('environment','PROD'),('warehouseId','0'),('batchPrefixHash',
  bad=scope|{key:value}
  try:m.validate_scope(bad);raise AssertionError('invalid scope accepted')
  except RuntimeError:pass
+import base64
+original_factory=m.runtime_class
+class MissingState:
+ def __init__(self,*_):pass
+ def load(self):raise FileNotFoundError('private-state-path-must-not-escape')
+m.runtime_class=lambda _:(MissingState,{'common_tools':lambda _: {}})
+try:m.execute({'action':'status','scope':scope,'baseSource':base64.b64encode(b'offline').decode(),'commonSource':base64.b64encode(b'offline').decode()});raise AssertionError('missing state accepted')
+except FileNotFoundError as e:
+ d=m.safe_diagnostic(e);assert d['diagnostic']=={'stage':'RUNTIME_STATE_READ','errorType':'FileNotFoundError'};assert 'private' not in json.dumps(d)
+m.runtime_class=original_factory
 print('OFFLINE_RUNTIME_PASS')
 `;
 test('reviewed Docker methods retain exact target, one-property overlay, journal uncertainty and restore-before-cleanup',()=>{