ci(track-a): discover hosted exact-client staging

[blakinio]

Track A shared hosted-input unblocker

Task: OTC-20260816-track-a-hosted-client-staging-discovery
Base: current main@dbd9520e2f8cc5a26f556bffaae2a83e139615f9
Execution: GitHub-hosted only, runtime_access:none, no client execution.

P2 #310 and worldmap #367 are both blocked because direct guessed/static package URLs failed from GitHub-hosted runners. This Draft performs one materially different discovery path:

1. fetch the current official public Tibia play/download page using browser-compatible headers and no credentials;
2. derive the Linux tarball URL from that official page rather than guessing a static/download endpoint;
3. require an official tibia.com host;
4. download tibia.x64.tar.gz only to ephemeral hosted storage;
5. list/extract only locally and compare any client candidates to the exact Track A fence (51965216, SHA-256 e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe);
6. upload no package/client/BattlEye bytes or artifacts and delete all downloaded/extracted bytes on exit.

Possible terminal classifications are EXACT_STAGING_AVAILABLE, CURRENT_OFFICIAL_BUILD_DIFFERS, or INPUT_BLOCKED. A mismatch does not get relabelled as exact evidence and does not authorize Synology static fallback.

The official Tibia Linux FAQ identifies the supported archive filename as tibia.x64.tar.gz; this workflow uses the current official page only to derive the actual present-day URL.

No login, credentials, client execution, BattlEye analysis, Synology access, Track B mutation, owner Codex quota, OpenAI API token or owner-funded paid AI quota is used.

[blakinio]

COORDINATOR TERMINAL DISPOSITION: INPUT_BLOCKED / close unmerged. This one-shot hosted discovery is exhausted. Its run 31951153838 failed before producing an exact-client staging match, while the independent current #367 evidence has already established the owner-supplied/reproduced official tibia.x64.tar.gz as the launcher/updater distribution rather than the 51,965,216-byte installed exact-client ELF, and a materially different hosted launcher-manifest probe returned HTTP 403. The official Linux FAQ confirms the supported tarball packaging path, but that does not make the installed exact build directly hosted-readable. Do not add another guessed/direct/WARP HTTP retry and do not fall back to Synology static analysis. Resume only if a legally/technically compliant GitHub-hosted-readable exact fenced input or a pre-sanitized exact-binary evidence bundle becomes available. Consumers #310 and #367 retain this blocker explicitly.