fix(config): harden remote and identity validation

cocoscreator_projects/framework-tests/config/remote-config-fetcher.test.ts

@@ -2,6 +2,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { HttpConfigFetcher } from '../../YouleNexus/assets/framework/config/remote-config-fetcher.ts';
 import { resolveRuntimeConfig } from '../../YouleNexus/assets/framework/config/runtime-config.ts';
+import { ConfigFetchError } from '../../YouleNexus/assets/framework/config/remote-config.ts';
 
 test('HttpConfigFetcher：POST 空 body，并无条件以 ? 拼接 cache bust', async () => {
   const calls: Array<{ input: string; init?: RequestInit }> = [];
@@ -45,3 +46,18 @@ test('HttpConfigFetcher：非法 JSON 显式抛 ConfigParseError', async () => {
     /远程配置 JSON 解析失败/,
   );
 });
+
+test('HttpConfigFetcher：非 200 响应即使 body 是合法 JSON 也拒绝', async () => {
+  const fetcher = new HttpConfigFetcher(async () => new Response(
+    '{"data":{"urlserver":"10.0.0.1:3088"}}',
+    { status: 503 },
+  ));
+  await assert.rejects(
+    fetcher.fetch('https://config.example/file.txt', () => '123'),
+    (error: unknown) => {
+      assert.equal(error instanceof ConfigFetchError, true);
+      assert.match((error as Error).message, /status 503/);
+      return true;
+    },
+  );
+});