feat(headless): Campaign OP slice OP7 — declared characterOptions with seed-diff sends

Adds an optional, strict `characterOptions` block to the headless bot config
(D8): keys are exactly the lane-B tier-1 (22) + tier-2 (4) bot-declarable
CharacterOptionId enum-member spellings; an unknown/out-of-tier name fails
config load naming the offending key, before it can ever reach the wire.

HeadlessCharacterOptionsSeeder diffs declared-vs-actual once both of ACE's
real preconditions are known true — GameActionLoginComplete sent (the
FirstEnterWorldDone gate SetCharacterOptions 0x01A1 needs) and a real
PlayerDescription has seeded RuntimeCharacterOptionsState
(HasServerSeed) — learned from whichever of two hooks lands second. Every
differing id routes through OP1's shared IRuntimeCharacterCommands seam:
auto-save ids send SetSingleOption (0x0005) immediately; batched ids also
call SetSingleOption (which only dirties the module) followed by exactly
one SaveOptions flush after the whole declared set has been walked.
Idempotent on reconnect by construction — no dedupe latch, the diff simply
finds nothing once the server agrees.

RuntimeLiveEntitySessionController gains a passive onLoginCompleteSent
observation hook (additive only, never changes when/whether it sends) so
the headless host can learn ACE's gate opened from any of its own two
internal send sites; the third site (direct first-entry completion) is
already owned by HeadlessSessionHost itself. All wiring is synchronous
delegate calls on Runtime's one dedicated update thread — no new
async/Task continuation, honoring #368.

Tests: schema (valid parse, unknown/tier-3 name rejected naming the key,
non-bool rejected, empty/absent no-op), the diff engine against a fake
IRuntimeCharacterCommands (nothing-to-send, auto-save-only, batched-with-
flush, mixed ordering, reconnect idempotence), and two wiring integration
tests — one dispatching a real PlayerDescription game event end-to-end to
a captured wire action, one proving the send lands on the same dedicated
thread every Tick runs on. Full solution suite: 12,935 passed / 4 skipped
/ 0 failed (+17 over baseline 12,918/4/0).

No register row: the characterOptions bot-config surface is acdream-
native tooling over retail's own wire mechanisms (both already ported by
OP1), not a retail UI port with a divergence to record.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Headless/Configuration/HeadlessConfiguration.cs

@@ -48,6 +48,24 @@ internal sealed class HeadlessSessionDescriptor
 
     [JsonRequired]
     public HeadlessCredentialReference Credential { get; init; } = new();
+
+    /// <summary>
+    /// Campaign OP slice OP7 (2026-08-11), D8: optional declared character-
+    /// option overrides. Keys MUST be exact <c>CharacterOptionId</c> enum-
+    /// member spellings drawn from the lane-B tier-1+tier-2 bot-relevant
+    /// subset (docs/research/2026-08-10-character-options-map.md §5.2/§7.3)
+    /// — <see cref="HeadlessConfigurationLoader"/> rejects everything else
+    /// at load, before any name can reach the wire (ACE throws
+    /// <c>KeyNotFoundException</c> server-side on an unmodelled id — set-
+    /// character-options-wire.md §5.4.2). Dictionary VALUES bypass the
+    /// loader's camelCase property-naming policy entirely (only C# property
+    /// names go through that policy; JSON object keys inside a
+    /// <c>Dictionary&lt;string, TValue&gt;</c> are read verbatim), so the
+    /// exact PascalCase enum spelling is what the config file must contain.
+    /// <c>null</c> (the field entirely absent) and an empty object are both
+    /// legal no-ops.
+    /// </summary>
+    public Dictionary<string, bool>? CharacterOptions { get; init; }
 }
 
 internal sealed class HeadlessEndpointDescriptor