Made of little things.

# soyLI 0.23.0 blocks dynamic-module check, capture and publication

> Follow-up: [responsive editing and soyLI 0.23.1 verification](responsive-editing.md).
> The original findings below describe the earlier 0.23.0 run.

Platform: darwin-arm64. `soyli update` reports 0.23.0 is current.

## Reproduction

With `backend.modules: ["backend/backend.json"]` and valid tracked manifest,
handler and schema files:

1. `soyli backend check` compiles successfully.
2. `soyli dev --no-open` runs the module correctly. Two browser contexts can create,
   read and edit the same persistent instance.
3. `soyli check` fails with `BROWSER_CHECK`, cause `ENOENT`, lstat
   `/…/napplet-publish-check-…/backend`.
4. `soyli multiplayer tests/multiplayer.mjs --latency 50 --jitter 15` fails before
   any scenario assertion, with `ENOENT`, lstat `/…/soy-multiplayer-…/backend`.
5. Committing the module files does not change either error.

## Cause observed in the installed executable

The frozen-creation browser check creates a temporary project and copies only the
artifact, napplet.json and managed assets before starting the local CVM. The local
CVM then resolves every declared module relative to that temporary root. Its
manifest/handler/schema files were not copied there.

The multiplayer runner similarly writes napplet.json and the artifact into a
new temporary directory, then starts the local CVM without its declared module
files. Recording/screenshot reuse the frozen browser-check path.

## Suggested fix

Copy each declared module manifest and its validated entry/schema files into the
isolated project before initializing its backend. For publishing/capturing, use
the already frozen source bytes so the tested code equals the reviewed release.
Retain existing path traversal, symlink, extension, schema and compilation checks.
Do not read changing working-tree files after the publication snapshot is frozen.

Add regressions for check, screenshot, record and multiplayer with a nested
module, plus a creation without modules. Assert that temporary backend state is
isolated from the dev database and that failure still removes the temporary copy.

## Delivery state

Napcraft retains its real module declaration and validation. No check has been
bypassed and nothing has been published. The creator said a patched build will be
implemented after this task. After the patch, rerun all host checks and captures,
commit, publish the source/frontend, then deploy `backend/backend.json` and verify
the signed receipt and public gameplay. Public provider admission remains to be
established by deployment; provider discovery alone does not prove admission.

The generated public `.napplet-space/soy-backend.json` must remain locally
available for builds. Tracking it triggered `SOURCE_SECRET` in the current CLI;
it is excluded from Git again. It contains only public provider/module metadata.
The provider and module declaration remain in tracked napplet.json. Regenerate the
context with `soyli backend init` / `soyli backend sync` in a fresh checkout.