Fix local run freshness and plugin asset handling

platform/validator/resources_test.go

@@ -1,6 +1,7 @@
 package validator
 
 import (
+	"encoding/base64"
 	"strings"
 	"testing"
 
@@ -79,10 +80,12 @@ func TestValidateGamePluginManifestRegistrationValidatesAssetFileCoverage(t *tes
 	registration.Manifest.AssetFiles = []domain.PluginAssetFile{
 		{Path: "actions/install.json", Mode: 0o600},
 		{Path: "bin/install-server", Mode: 0o700},
+		{Path: "assets/map.bin", Mode: 0o600},
 	}
 	registration.AssetFiles = []domain.PluginAssetFile{
 		{Path: "actions/install.json", Content: "{}", Mode: 0o600},
 		{Path: "bin/install-server", Content: "#!/usr/bin/env sh\n", Mode: 0o700},
+		{Path: "assets/map.bin", Content: base64.StdEncoding.EncodeToString([]byte{0xff, 0x00, 0x7f}), Encoding: "base64", Mode: 0o600},
 	}
 	if err := ValidateGamePluginManifestRegistration(registration); err != nil {
 		t.Fatalf("expected declared asset files with matching content to validate, got %v", err)
@@ -105,6 +108,12 @@ func TestValidateGamePluginManifestRegistrationValidatesAssetFileCoverage(t *tes
 	if err := ValidateGamePluginManifestRegistration(inlineContent); err == nil || !strings.Contains(err.Error(), "content must be supplied only") {
 		t.Fatalf("expected manifest inline content rejection, got %v", err)
 	}
+
+	unsafeEncodedText := domain.CopyGamePluginManifestRegistration(registration)
+	unsafeEncodedText.AssetFiles[2].Content = base64.StdEncoding.EncodeToString([]byte("password=secret"))
+	if err := ValidateGamePluginManifestRegistration(unsafeEncodedText); err == nil || !strings.Contains(err.Error(), "content is unsafe") {
+		t.Fatalf("expected unsafe base64 text rejection, got %v", err)
+	}
 }
 
 func TestValidateGamePluginManifestRegistrationValidatesRuntimeProfiles(t *testing.T) {