fix(validators): libretro/RetroDECK format compat (GBA signature + GB rtc)

[terafin]

Summary

Two related libretro-vs-standalone validator gaps in one batch — both fix real data-loss paths reported by SGM-Helper users on Steam Deck (RetroDECK) and SS1 (libretro cores). Both stay strict for anonymous uploads, both ship with happy-path + regression-guard tests.

Consolidates and supersedes PR #8 + PR #9 — same files (nintendo_validation.go, raw_save_validation.go), same lens (libretro-vs-standalone format gaps), squashed to one commit.

Part 1 — GBA library-signature advisory under helper trust (was #8, fixes #7)

Standalone mGBA / VBA-M write a library version footer (EEPROM_V, SRAM_V, FLASH_V, FLASH1M_V, FLASH512_V) into the .srm. RetroArch's libretro-mGBA core does NOT — confirmed across both EA Sports games (007 - Everything or Nothing, header 3500DNOB) and canonical mGBA-targeted titles (Pokemon Emerald, sparse FRAM data). RSM's hasGBASignature() rejects every libretro GBA save → HTTP 422.

Adds SignatureAdvisoryWithHelperTrust bool to strictRawSaveValidationProfile. When true, a failing RequireSignature check is downgraded from reject → warning IFF HelperTrusted AND rom_sha1 present AND payload non-blank. Anonymous uploads or uploads without rom_sha1 still hard-reject. GBA's profile opts in.

Part 2 — Game Boy .rtc sidecar size validation (was #9)

RetroArch / libretro Game Boy cores write a small .rtc sidecar next to the canonical .srm for cartridges with real-time clock state (Pokemon Crystal, Pokemon Gold/Silver, Harvest Moon GBC). Observed sizes 8–48 bytes. The strict gameboy raw-save profile's AllowedSizes only listed canonical SRAM sizes (512..65536), so every .rtc upload rejected with HTTP 422 → silent data loss for clock state.

Adds optional `AllowedSizesByExt map[string]func(int) bool` to `strictRawSaveValidationProfile`. When the incoming extension matches a registered predicate, that predicate replaces the canonical size-set check for that extension only. Gameboy opts in for `.rtc` with `1..=64` bytes.

`.sav` / `.srm` / `.ram` / `.gme` still validate against `strictRawGBSizes` exactly as before — scoped relaxation, not a blanket loosening.

Tests (7 new)

• `AcceptsLibretroGBASaveUnderHelperTrust` — happy path
• `RejectsLibretroGBASaveWithoutHelperTrust` — anonymous upload still rejected
• `RejectsLibretroGBASaveWithoutROMSHA1` — same
• `RejectsBlankLibretroGBASave` — blank payload still rejected even under trust
• `AcceptsTinyGameBoyRTCFile` — 8/13/32/48/64-byte `.rtc` happy path
• `RejectsTinyGameBoySRMFile` — regression guard: 8-byte `.srm` still rejected, proves `.rtc`-scoped relaxation
• `RejectsOversizedGameBoyRTCFile` — 65-byte `.rtc` rejected with new per-ext message

Scope

• Only GBA opts into `SignatureAdvisoryWithHelperTrust`; only gameboy opts into `AllowedSizesByExt`. Every other system's behavior is byte-identical to before.
• Pre-existing trust / blank / executable-payload / text-noise checks still run — only the size predicate and signature requirement get the per-extension / per-trust-context overrides.

🤖 Generated with Claude Code