[F3] Pin ancillary Config Server downloads and expose safe DCL provenance

Follow-up F3 from the product-version selector discussion. This issue tracks implementation work; the decision to keep host/serviceId/envTag lookup does not complete it.

Coordinating owner: @stevehu — Java DCL transport, diagnostics, and log-safety coordination.

Scope and acceptance criteria

Capture x-light-config-snapshot-id from the successful /configs response and
pass that exact snapshotId to /certs and /files. This uses existing server
support and does not depend on F5. Preserve the authorized host/service/env and
phase on all requests. Do not resolve current again between these calls.

Capture the host, instance, snapshot, and values-content-digest response headers
as non-secret provenance. Log/expose them through a supported runtime information
surface only with accurate state: fetched, written, and successfully adopted are
different stages. Track startup versus reload, remote versus local source, and
partial/failed bundle status. Verify the digest over the raw response before
parsing if claiming transport-content verification; do not imply it attests
in-memory values or ancillary files.

Report endpoint-specific success/failure without logging response payloads:
the present shared “configs” error and empty-map result obscure whether certs
or files failed. Remove/redact loadFiles DEBUG payloads, loadConfigs TRACE
values, and raw HTTP error bodies, including exception messages. Preserve useful
endpoint category, status, and non-secret provenance rather than secret content.

Acceptance: activate snapshot B between values and ancillary calls for A and
verify every downloaded asset still belongs to A. Exercise missing/malformed
headers, older servers, unavailable snapshots, and write failures with explicit
behavior. After a successful values fetch, make /certs and /files independently
return >=300 or fail to connect; each failure must be distinguishable from a
successful empty inventory and must not yield a complete-bundle success claim.
Test at INFO, DEBUG, and TRACE with sentinel secrets in values, binary file maps,
and error bodies; none may appear in logs or exposed provenance. Do not claim
bundle-wide reload support while reload only fetches values. Coordinate F3 and
F7 as linked light-4j DCL work items with clear failure-state ownership.

Implementation area and related history

server/src/main/java/com/networknt/server/DefaultConfigLoader.java, runtime-information exposure, and targeted loader tests. Related completed work: networknt/light-4j#2752 (source logging), networknt/light-4j#2753 (downloaded filenames), and networknt/light-4j#2785 (legacy request compatibility). These do not provide the snapshot pinning/provenance requested here.

Design reference

Product Upgrade Runtime Contract (publication accompanies the approved documentation change). F identifiers refer to the sections of that design. The related work below is tracked separately; these links are coordination references, not a claim that every item blocks this issue.

Related implementation issues

• F7: networknt/light-4j#2791
• F4/runtime: networknt/light-4j#2792
• F5: lightapi/portal-service#82