Validate and atomically install downloaded EMC defaults

[Exohayvan]

Summary

The automatic default-EMC updater downloads the mutable Common branch and directly overwrites the live local file without validating the document or preserving a known-good copy.

Evidence

• DefaultEmcValueUpdateMonitor fetches raw defaults.yaml from refs/heads/common and writes it with Files.writeString(...).
• There is no schema compatibility check, required-section validation, minimum entry validation, temporary sibling, atomic move, or backup.
• EmcValueYamlParser is permissive enough that many malformed documents become an empty schema/value set instead of producing a hard validation failure.
• The updater runs across all Minecraft loader implementations.

Impact

An accidental empty/malformed Common commit or interrupted local write can replace working defaults and leave installations with empty, partial, or unparsable EMC values after restart.

Reproduction / verification

• Serve empty, malformed, wrong-schema, and truncated documents through a test HTTP endpoint.
• Inject interruption between download and replacement.
• Verify the original file remains byte-for-byte usable on every failure.

Proposed direction

Download to a temporary sibling, parse and validate the complete document, enforce compatible schema/content rules, flush, atomically replace, and retain a recoverable backup. Prefer release-pinned content over a mutable branch.

Acceptance criteria

• Invalid remote content never replaces the current defaults.
• Interrupted updates preserve the previous valid file.
• Successful updates are atomically installed and validated before restart messaging.
• Tests cover empty, malformed, incompatible, interrupted, and valid downloads.

Audit provenance

Candidate #12 from the read-only repository audit performed on 2026-07-20. This is separate from existing issues #3, #4, #25, and #27 unless explicitly linked later.