test: Pin the desktop mod-discovery expectations to the '/' seam

Moving mod discovery onto the Vfs seam made it join the found folder name with
'/', so on Windows the returned root is the native mods dir plus '/CnMod 1.3.1'
and the node-joined expectation no longer matched. The installed root is now
built the way discovery builds it, and the hand-picked root stays natively
spelled to keep proving that a picked path is validated, not rewritten.

fix: Restate the HUD-scale bounds where the old formula was quoted

The layout sweep in details-panel-layout built its anchors from `uiScaleFor`,
so the ceiling collapsed its two largest entries onto duplicates of the third
and dropped the wide layouts it existed to cover; it now spans the reachable
band and keeps one pinned high scale. The window-placement ticket claimed 2x
was reachable in play, which the ceiling makes false.

chore(deps): bump undici (#3)

Bumps  and [undici](https://github.com/nodejs/undici). These dependencies needed to be updated together.

Updates `undici` from 7.28.0 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v7.29.0)

Updates `undici` from 6.27.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v7.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix: Split either separator when resolving a source path

resolveSourceFile split on the platform sep, but callers pass two shapes:
joined constants carry the platform separator, while ini-borne references
arrive forward-slashed from normalizeAssetPath. On Windows the normalized
shape never split, so the whole reference became one segment, the walk
missed, and the armor recipes degraded the player LUT from 5 tiers to 1 -
failing the pipeline's player-colours test on that platform only.

docs: Re-measure the planner and file the combat spatial rebuild

Three perf commits have landed since this ticket recorded its numbers,
and each removed the term it named. The walk-block union copy went in
c5a6428, the farmer's sow scan in c70b50e. Re-profiling on an idle box
finds no planner hotspot left: the ladder is spread thin, and combat has
overtaken the planner as the heaviest slot, 31.0% against 24.4%.

Rewrite ai-planner-scale-curve to the work that is actually left, the
population/map-area axis split still blocked on the synthetic fixture,
and record that measuring this on a loaded box distorts the shares
themselves rather than only the timings.

File the combat finding: combatSystem walks its target list twice per
tick with the same nodesOf resolver, once into NodeBuckets and once into
HostilePresence, which is 20.6% of step between them.

fix: Stop the overlay claiming a shortfall on a session that has none

The delivered-speed readout smoothed a per-frame ratio, and `steps` is an integer: at 60 fps and x1 the
loop runs one tick every fifth frame, so every sample read either 0 or 5 and the average sawtoothed
between 0.80 and 1.22 forever. The arrow fired on 20% of frames at x1 and 35% at x0.25 while the loop
was delivering exactly what was asked and discarding nothing, and the line reflowed at frame rate.

Delivered speed is now a time average over a rolling one-second window rather than a smoothed
per-frame ratio, and the arrow is gated on a shortfall that survived two consecutive windows. Loading
a map costs a few ticks on every session; that is a hitch the loop recovers from within a window, not
the machine failing to keep up. Frames long enough to be a blocking load or an unpainted tab are kept
out of the average entirely.

The dropped-tick count follows the same window instead of the monotonic session total, so a stall
leaves the readout once it stops rather than pinning a number there for the rest of the session.

Verified in a browser on magiczny_las with six AI seats: x1 and x0.25 are arrow-free and drop-free
both immediately after load and settled, and x10 reports the shortfall on every frame.

feat: Drive the carry look from the original's [gfxwalkatomic] table

Settlers delivering honey hauled a wood log. The per-good carry animation was a
hand-maintained name join from the good's slug to a `<body>_walk_<slug>` bobseq,
and every good with no cycle of its own — 26 of 65, honey among them — fell back
to the character's generic loaded gait, which is the log.

The join is not guesswork the project has to make: the mod ships the table in
plaintext. `DataCnmd/animation/mapmoveableanimations/animations.ini` carries 511
[gfxwalkatomic] records keyed (logictribe, logicjob, logicgoodtype) ->
gfxbobseqbody, in the same file the pipeline already reads for [bobseq] and
[gfxanimatomic]. Extract them into ir.json `gfxWalkAtomics` and bind the loaded
gait from them instead of from the good's name.

The table contradicts what a name join can reach: honey binds the potion cycle,
wool the flour sack, ornament the stone pillar, the amulets the tile hold, and
all four armours share the leather bundle. It also corrects two pre-existing
mismatches (coin, food_extra) and settles two open questions with data — the
woman's nine hauled goods, and the soldier binding its empty walk for every good,
so a warrior never shows a load.

Where the table covers a job it is complete, so no generic fallback applies: a
good it omits genuinely draws no load. The `<prefix>wood` gait remains only as
the floor for an IR without the lane.

The remaining fidelity gap is the per-good palette recolour the original applies
on top (honey and the potions share one cycle), filed as
docs/tickets/render/per-good-carry-recolour.md.

docs: File deferred camera-controller tickets from the edge-drift review

Two review discoveries left out of the edge-drift fix: sharpen the existing
DOM-test-environment ticket with the camera controller as a second silent-
regression instance and a jsdom test target, and file the pre-existing
alt-tab-refocus edge-scroll quirk (edge-pan doesn't resume when the cursor is
already over the canvas on return).

refactor: Delete the stale sandbox scene copy the bench still built from

Re-expose the offset-taking buildSandboxSettlement(sim, ox, oy) and
SANDBOX_SETTLEMENT_PITCH from src/scenes/sandbox/, point bench/world.ts
at them, and delete the dead full copy in src/scenes/sandbox.ts that had
already let a scene-budget edit land in the wrong world.

The bench's tiled world hash moves to the live scene's placements — the
intended one-time re-baseline, not a regression. New
ON_BENCH_SETTLEMENTS=1 state hash: b7f24f60.

fix: Apply the mod-root review-battery findings

Pipeline: the two-root union now dedups on the case-folded relative path
(overlay wins a case-divergent spelling, as an over-install on the default
case-insensitive filesystems would); resolveModRoot moved beside SourceRoots
and requires DataCnmd to be a directory; readSourceFile loop simplified;
stale --mod prose trimmed. Fidelity pinned for real: a clean base (real
install minus every zip-shipped file) converted with --mod-root is
byte-identical to the same base with the mod extracted over it, except the
manifest's provenance paths.

Desktop: the wizard's Cancel now also aborts the extraction phase (and reads
as a cancellation, not a failure); mod events are throttled like pipeline item
events; ModInstallEvent deduped into ipc.ts's ModEvent; .installing/ staging
is never discovered as an installed mod and a running download blocks
conversion; a stale hand-picked modPath is dropped from the config. Zip
reader hardening: inflate capped at the declared uncompressed size (zip
bombs), central-directory/entry offsets validated against the file size, EOCD
candidates must reach end-of-file, Windows drive-relative member names
rejected, Drive confirm-form action pinned to google.com, non-2xx hops
surface their status, and the interstitial read is bounded.