fix(physics): port retail's find_bbox_cell_list outdoor extent walk (#334)

acdream had never implemented retail's SECOND cell-membership algorithm.
CPhysicsObj::calc_cross_cells @0x00515230 tests HAS_PHYSICS_BSP_PS at
0x00515285 and jumps (0x0051528f jne 0x515305) to find_bbox_cell_list
@0x00510fc0 for a BSP-bearing object; everything below that jump is the
OTHER algorithm, CObjCell::find_cell_list, and that is all we had. Every
object, BSP-bearing or not, was routed through it.

That path's outdoor expansion is a HARD CAP of one cell in each direction.
CellTransit.AddAllOutsideCells computes minRad = radius, maxRad = 24 - radius
and adds at most the eight neighbours of the sphere's own cell, so for any
radius >= 12 m both boundary tests are unconditionally true and the result is
exactly 3x3. Widening the radius or adding a second sphere is mechanically
incapable of adding a tenth cell. The user's live probe measured the
consequence directly: standing inside a Neftet formation, inCell=2 exempt=2
reached=0 -- the geometry was not a candidate at all.

The port. AddAllOutsideCellsFromParts is CLandCell::add_all_outside_cells
@0x00533360 plus add_cell_block @0x005331d0: base landcell from the FIRST
part's own adjust_to_outside, baseX/baseY within-block, each part's authored
CGfxObj::gfx_bound_box re-fit through all eight corners
(BBox::LocalToGlobal @0x005b2120), floor(v / square_length) where
square_length = 0x7c920c = 24.0f, four accumulators seeded to zero, ONE
rectangle unioned across all parts, FILLED, in GLOBAL lcoords so it crosses
landblocks freely, clamped only to [0, 0x7f8).
BuildShadowCellSetFromParts is find_bbox_cell_list's worklist.
RegisterMultiPart dispatches on the same flag retail does, and
BuildFloodSpheres' BSP arm is deleted rather than left unreachable.

Disassembled from the PDB-paired 2013-09-06 binary, not read from Binary
Ninja: BN mis-renders four separate constructs inside add_all_outside_cells
alone -- a dropped `and eax,0xffff` on baseX, a neg/sbb/and select shown as
identically zero, a wrong get_landcell argument, and both x87 flag tests as
`unimplemented {test ah}`.

ShadowPartGeometry pairs the BSP root sphere with the authored box so no
resolver can answer one and leave the other call site to synthesize a
substitute -- the AP-156 invariant applied a second time, since that split is
what produced AP-156 and then this. The box comes from
FlatGfxObjVisualBounds, already computed by exactly CGfxObj::init_end's
algorithm and already in the prepared package: no bake change, no DAT re-read.

Cost, measured over the installed DATs before any code was written: 1,258
physics-BSP GfxObjs, cells/object p50 4, p90 4, p99 12, max 49. The port is
CHEAPER than the old 3x3 = 9 for 98.97% of them. Row totals (shapes x cells)
over all 1,031 landblocks with BSP owners fall 97,173 -> 15,607 (0.161x);
dense Arwic 0xC6A9 falls 342 -> 43. One landblock more than doubles.

Precondition confirmed before pinning any expected cell set: 0x010046D8's box
is 96 m x 96 m about cell (2,2) = 0x87640013, which independently corroborates
the 3x3-centred-there diagnosis, and its rectangle does contain 0x87640011 and
0x87640019 -- the two cells the probe measured empty.

Register: AP-156's outdoor half CLOSED and its risk column CORRECTED (it read
"extra broadphase candidates, never a missed one", which generalised the indoor
direction to the whole row and is why #334 sat inside it unnoticed). AP-159 +
issue #335 file the unported indoor arm; AD-49 records the seed-time rectangle.
Issue #336 files a fourth load-sensitive test flake seen once during the gate.

Ten tests, every one sabotage-verified in both directions across eight
mutations (dispatch, 8-corner refit, floor-vs-truncation, union-vs-per-part,
map clamp, adjust guard, landblock clamp, box-path-for-everything). The
strongest is an installed-DAT replay of the user's own probe evidence.
Suite 11,208 -> 11,218 passed / 4 skipped / 0 failed; the +10 is exactly the
new tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/AcDream.Core/Physics/ShadowPartBox.cs

@@ -0,0 +1,171 @@
+using System.Numerics;
+
+namespace AcDream.Core.Physics;
+
+/// <summary>
+/// One physics-BSP part's flood geometry, resolved as ONE value: the part
+/// GfxObj's physics-BSP root bounding sphere AND the axis-aligned box of its
+/// vertex array, both in the GfxObj's own unscaled frame.
+///
+/// <para>
+/// The pairing is the AP-156 invariant applied a second time. Retail's cell
+/// membership reads BOTH — <c>CEnvCell::find_transit_cells</c> @0x0052cae0
+/// takes <c>CGfxObj::physics_sphere</c> (<c>[gfxobj+0x74]</c>) for its cheap
+/// portal-plane reject, and <c>CLandCell::add_all_outside_cells</c> @0x00533360
+/// takes <c>CPhysicsPart::GetBoundingBox</c> @0x0050d600
+/// (<c>&amp;gfxobj-&gt;gfx_bound_box</c>) for the outdoor extent walk. A resolver
+/// that answered only one of the two would leave the other call site to
+/// synthesize a substitute, which is exactly how the sphere came to be placed
+/// at the part origin (AP-156) and how #334's outdoor rectangle came to be a
+/// fixed 3×3.
+/// </para>
+///
+/// <para>
+/// <see cref="BoxMin"/>/<see cref="BoxMax"/> come from
+/// <c>FlatGfxObjVisualBounds</c>, which
+/// <c>FlatCollisionAssetBuilder.FlattenGfxObj</c> computes with
+/// <c>PhysicsDataCache.ComputeVisualBounds(source.VertexArray)</c> — the exact
+/// <c>CGfxObj::init_end</c> @0x00534200 computation (seed min=max=vertices[0],
+/// then <c>BBox::AdjustBBox</c> over every vertex of the render vertex array,
+/// which is also the array the physics polygons index into).
+/// </para>
+/// </summary>
+public readonly record struct ShadowPartGeometry
+{
+    private ShadowPartGeometry(
+        FlatCollisionSphere sphere,
+        Vector3 boxMin,
+        Vector3 boxMax)
+    {
+        Sphere = sphere;
+        BoxMin = boxMin;
+        BoxMax = boxMax;
+    }
+
+    /// <summary>Retail <c>CGfxObj::physics_sphere</c> — the physics BSP root
+    /// bounding sphere, origin included, unscaled.</summary>
+    public FlatCollisionSphere Sphere { get; }
+
+    /// <summary>Retail <c>CGfxObj::gfx_bound_box.m_vMin</c>, unscaled.</summary>
+    public Vector3 BoxMin { get; }
+
+    /// <summary>Retail <c>CGfxObj::gfx_bound_box.m_vMax</c>, unscaled.</summary>
+    public Vector3 BoxMax { get; }
+
+    /// <summary>
+    /// Pairs the two. <paramref name="visualBounds"/> is the prepared
+    /// package's <c>FlatGfxObjVisualBounds</c>; when it is absent (graph-only
+    /// fixtures, and prepared assets baked without the field) the box falls
+    /// back to the sphere's own axis-aligned bound, which contains every
+    /// physics polygon vertex the sphere contains and keeps the substitution
+    /// in the over-inclusive direction retail itself uses (§1.8 of
+    /// <c>docs/research/2026-08-06-334-contract.md</c>). The fallback lives
+    /// HERE so no call site can observe a half-populated value.
+    /// </summary>
+    public static ShadowPartGeometry Create(
+        FlatCollisionSphere sphere,
+        FlatGfxObjVisualBounds? visualBounds)
+    {
+        if (visualBounds is { } bounds)
+            return new ShadowPartGeometry(sphere, bounds.Min, bounds.Max);
+
+        var extent = new Vector3(sphere.Radius);
+        return new ShadowPartGeometry(
+            sphere,
+            sphere.Origin - extent,
+            sphere.Origin + extent);
+    }
+}
+
+/// <summary>
+/// One physics-BSP part's world-placed bounding box — the per-part input to
+/// retail's outdoor extent walk.
+///
+/// <para>
+/// Retail's <c>CLandCell::add_all_outside_cells</c> @0x00533360 calls
+/// <c>BBox::LocalToGlobal(part-&gt;gfxobj-&gt;gfx_bound_box, part-&gt;pos,
+/// cell0-&gt;pos)</c> (@0x00533527) per part, so the box it divides by
+/// <c>square_length</c> is the part's authored box re-fit through the part's
+/// own placement. <see cref="LocalMin"/>/<see cref="LocalMax"/> are that
+/// authored box (entity-scaled); <see cref="WorldPosition"/>/
+/// <see cref="WorldRotation"/> are the part placement
+/// <see cref="ShadowObjectRegistry.RegisterMultiPart"/> composes for the
+/// <c>ShadowEntry</c> rows, so the flood and the geometry can never disagree
+/// about where the part is.
+/// </para>
+///
+/// <para>
+/// CONSTRUCTION IS BY FACTORY ONLY: min and max arrive together, from one
+/// <see cref="ShadowShape"/>, so no future producer can carry one and drop the
+/// other.
+/// </para>
+/// </summary>
+public readonly record struct ShadowPartBox
+{
+    private ShadowPartBox(
+        Vector3 localMin,
+        Vector3 localMax,
+        Vector3 worldPosition,
+        Quaternion worldRotation)
+    {
+        LocalMin = localMin;
+        LocalMax = localMax;
+        WorldPosition = worldPosition;
+        WorldRotation = worldRotation;
+    }
+
+    /// <summary>Authored box minimum in the part's own frame, entity-scaled.</summary>
+    public Vector3 LocalMin { get; }
+
+    /// <summary>Authored box maximum in the part's own frame, entity-scaled.</summary>
+    public Vector3 LocalMax { get; }
+
+    /// <summary>The part's world placement — retail <c>CPhysicsPart::pos</c>.</summary>
+    public Vector3 WorldPosition { get; }
+
+    /// <summary>The part's world orientation — retail <c>CPhysicsPart::pos</c>.</summary>
+    public Quaternion WorldRotation { get; }
+
+    /// <summary>
+    /// Composes the part's world placement exactly as
+    /// <see cref="ShadowObjectRegistry.RegisterMultiPart"/> composes the
+    /// emitted <c>ShadowEntry</c>'s.
+    /// </summary>
+    public static ShadowPartBox FromShape(
+        in ShadowShape shape,
+        Vector3 entityWorldPosition,
+        Quaternion entityWorldRotation)
+        => new(
+            shape.LocalBoundsMin,
+            shape.LocalBoundsMax,
+            entityWorldPosition
+                + Vector3.Transform(shape.LocalPosition, entityWorldRotation),
+            entityWorldRotation * shape.LocalRotation);
+
+    /// <summary>
+    /// Retail <c>BBox::LocalToGlobal</c> @0x005b2120 — a proper EIGHT-CORNER
+    /// re-fit, not a min/max transform: transform <c>min</c>, seed both
+    /// corners from it, transform the other seven and <c>AdjustBBox</c> each.
+    /// A rotated box therefore GROWS, conservatively, which is the direction
+    /// retail deliberately errs in.
+    /// </summary>
+    /// <param name="frameOrigin">World origin of the destination frame —
+    /// retail's <c>cell0-&gt;pos</c>, i.e. the landblock the extent walk
+    /// anchors on.</param>
+    public void RefitTo(Vector3 frameOrigin, out Vector3 min, out Vector3 max)
+    {
+        Vector3 offset = WorldPosition - frameOrigin;
+        min = new Vector3(float.MaxValue);
+        max = new Vector3(float.MinValue);
+        for (int corner = 0; corner < 8; corner++)
+        {
+            var local = new Vector3(
+                (corner & 1) == 0 ? LocalMin.X : LocalMax.X,
+                (corner & 2) == 0 ? LocalMin.Y : LocalMax.Y,
+                (corner & 4) == 0 ? LocalMin.Z : LocalMax.Z);
+            Vector3 world = Vector3.Transform(local, WorldRotation) + offset;
+            min = Vector3.Min(min, world);
+            max = Vector3.Max(max, world);
+        }
+    }
+}