tools(render): self-gate kit - session config, teleport route, runner

Lead-run visual gate: direct character login through a session config,
the owner-supplied /teleloc poses (cathedral floating stairs, Facility Hub
stairs, Holtburg house), one screenshot per pose into the automation
artifact directory, graceful close-client. The runner refuses to start
while any AcDream.App process exists and never hard-kills a client.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tools/overhaul-selfgate/run-selfgate.ps1

@@ -0,0 +1,71 @@
+# Campaign OVERHAUL self-gate runner (2026-09-02).
+#
+# Launches the Release client through a session config (direct character
+# login), plays tools/overhaul-selfgate/route.txt (teleports + screenshots),
+# and waits for the route's own close-client. Output: one directory per run
+# under logs/selfgate-<stamp>-<label>/ with the PNGs, the client log, and a
+# run.json naming the exact commit.
+#
+# Rules: refuses to run while any AcDream.App process exists (never touch an
+# owner-started client); closes only the client it started, gracefully.
+#
+# Usage (from the worktree root):
+#   .\tools\overhaul-selfgate\run-selfgate.ps1 -Label g2-candidate
+#   .\tools\overhaul-selfgate\run-selfgate.ps1 -Label baseline -Route .\tools\overhaul-selfgate\route.txt
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)] [string]$Label,
+    [string]$Route = (Join-Path $PSScriptRoot 'route.txt'),
+    [string]$Session = (Join-Path $PSScriptRoot 'session.json'),
+    [string]$Password = 'testpassword',
+    [int]$TimeoutSeconds = 300
+)
+
+$ErrorActionPreference = 'Stop'
+$repo = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+$exe = Join-Path $repo 'src\AcDream.App\bin\Release\net10.0\AcDream.App.exe'
+if (-not (Test-Path -LiteralPath $exe)) { throw "Release client not built: $exe" }
+if (Get-Process -Name AcDream.App -ErrorAction SilentlyContinue) {
+    throw 'An AcDream.App process is already running (owner client?). Not launching.'
+}
+
+$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
+$safeLabel = ($Label -replace '[^A-Za-z0-9._-]', '-')
+$out = Join-Path $repo "logs\selfgate-$stamp-$safeLabel"
+$artifacts = Join-Path $out 'artifacts'
+New-Item -ItemType Directory -Force -Path $artifacts | Out-Null
+
+Push-Location $repo
+try {
+    $commit = (git rev-parse --short HEAD).Trim()
+    $dirty = (git status --porcelain).Length -gt 0
+} finally { Pop-Location }
+
+$env:ACDREAM_SELFGATE_PASS = $Password
+$env:ACDREAM_UI_PROBE_SCRIPT = (Resolve-Path $Route).Path
+$env:ACDREAM_AUTOMATION_ARTIFACT_DIR = $artifacts
+$env:ACDREAM_AUTOMATION_EXACT_FRAMEBUFFER = '1'
+$clientLog = Join-Path $out 'client.log'
+
+[ordered]@{
+    label = $Label; commit = $commit; dirtyTree = $dirty
+    startedUtc = [DateTime]::UtcNow.ToString('o')
+    route = $env:ACDREAM_UI_PROBE_SCRIPT; session = (Resolve-Path $Session).Path
+} | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $out 'run.json') -Encoding utf8
+
+Write-Host "self-gate '$Label' at $commit (dirty=$dirty) -> $out"
+$proc = Start-Process -FilePath $exe -ArgumentList @('--session-config', (Resolve-Path $Session).Path) `
+    -RedirectStandardOutput $clientLog -RedirectStandardError (Join-Path $out 'client.err.log') `
+    -PassThru -WindowStyle Normal
+
+if (-not $proc.WaitForExit($TimeoutSeconds * 1000)) {
+    Write-Warning "client still running after $TimeoutSeconds s; requesting graceful close"
+    $null = $proc.CloseMainWindow()
+    if (-not $proc.WaitForExit(20000)) {
+        Write-Warning 'client did not close gracefully; leaving it (owner rule: never hard-kill)'
+    }
+}
+Write-Host "client exit code: $($proc.ExitCode)"
+Get-ChildItem -LiteralPath $artifacts -Filter '*.png' | ForEach-Object { Write-Host ("  {0}  {1:N0} bytes" -f $_.Name, $_.Length) }
+Write-Host "log: $clientLog"