chore: improve engineering excellence

[KevinTCoughlin]

Summary

• address high-confidence correctness, security, reliability, and maintainability gaps found during an engineering-excellence audit
• strengthen automated validation, CI/CD safety, documentation, and developer experience where applicable
• incorporate fixes from an independent regression review of the complete patch

Validation

• repository-specific tests, linters, builds, and static checks passed where supported by the local platform
• final git diff --check passed

Hardware-, platform-, or live-infrastructure-dependent checks are documented in the changed project guidance where applicable.

[Copilot]

Pull request overview

This PR tightens correctness and reliability around server JAR installation and container entrypoint configuration, and backs it up with targeted tests and CI enforcement consistent with an engineering-excellence hardening pass.

Changes:

• Make server JAR installs safer by downloading to a temp file, verifying checksums before replacing server.jar, and backing up/restoring on failures.
• Harden entrypoint.sh configuration substitution (escaping + newline rejection) and require an explicit RCON_PASSWORD, with a shell test added to CI.
• Improve reliability/strictness in CI and backup logic (tighter tidy check; ensure tar input files are closed with error propagation).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/entrypoint_test.sh	Adds a shell test validating entrypoint.sh escaping for RCON password and MOTD.
README.md	Updates Java version messaging and makes RCON_PASSWORD explicitly required with guidance.
internal/server/fabric.go	Avoids silent rename failure by returning an error; factors out installer versions URL.
internal/server/fabric_test.go	Adds regression coverage to ensure existing server.jar is restored on Fabric rename failure.
internal/server/download.go	Makes JAR downloads atomic and introduces structured backup/restore behavior.
internal/server/download_test.go	Adds tests for atomic replacement and preservation of existing JAR on checksum failure.
internal/management/backup.go	Ensures file handles are closed and close errors are surfaced after tar copy.
entrypoint.sh	Requires RCON_PASSWORD, adds escaping/newline validation, and refactors server.properties templating into a function.
.github/workflows/dependency-check.yml	Makes go mod tidy drift a hard failure via git diff --exit-code.
.github/workflows/ci.yml	Expands path filters and runs ShellCheck + entrypoint configuration test in CI.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[KevinTCoughlin]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved in 968ea40. Merged main and reconciled internal/server/download.go/download_test.go — kept main's retry logic, temp-file permission fix, and cross-platform renameOverwrite, plus this branch's backup/restore-on-failure for the Fabric install path. Build, vet, and tests all pass.