fix(net): ranged speech carries a range float our parser was eating

HearSpeech decoded 0x02BB and 0x02BC with one layout. They do not share one.
ACE's GameMessageHearRangedSpeech writes senderID, range, chatMessageType
where GameMessageHearSpeech writes only senderID, chatMessageType, and
holtburger's HearRangedSpeechData declares the same range: f32 that
HearSpeechData lacks. Two oracles, no ambiguity.

The consequence was quiet rather than loud. The tail is twelve bytes, our
guard demanded eight, so nothing ever failed to parse. We read the guid
correctly, then read range's float bits as the chat type and discarded the
real one. A shout at range 60.0f arrived with a chat type of 0x42700000
instead of 0x0B. Nothing downstream consumes ChatType for local speech today,
which is why this survived, but the record is public and any future consumer
would have inherited garbage.

TryParse now branches its tail size on the opcode and Parsed gains Range,
which stays zero for local speech because there is no such field on that
wire. The existing ChatTests ranged case was itself built on the misreading,
constructing a local-shaped tail; it is corrected to the oracle layout and
now asserts both range and chat type rather than only the ranged flag.

New golden tests drive both opcodes through AceWireWriter in ACE's write
order, covering empty strings, string lengths one through four so every
residue of the four-byte padding rule is exercised, CP1252 accented names,
and a regression pin asserting the chat type is not the range float's bits.
A ranged body four bytes short is now rejected instead of silently decoded.

Core.Net tests go 617 to 630, all green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.Core.Net.Tests/Messages/ChatTests.cs

@@ -102,19 +102,27 @@ public sealed class ChatTests
     [Fact]
     public void HearSpeech_TryParse_RangedFlag()
     {
+        // 0x02BC's tail is 12 bytes, not 8: ACE's GameMessageHearRangedSpeech
+        // writes senderID, range (f32), chatMessageType, where the local
+        // 0x02BB message writes only senderID and chatMessageType. This test
+        // previously built the local tail and so passed against a parser that
+        // read range's float bits as the chat type.
         byte[] msg = PackString16L("X");
         byte[] sender = PackString16L("Y");
-        byte[] inbound = new byte[4 + msg.Length + sender.Length + 8];
+        byte[] inbound = new byte[4 + msg.Length + sender.Length + 12];
         BinaryPrimitives.WriteUInt32LittleEndian(inbound, HearSpeech.RangedOpcode);
         int pos = 4;
         Array.Copy(msg, 0, inbound, pos, msg.Length); pos += msg.Length;
         Array.Copy(sender, 0, inbound, pos, sender.Length); pos += sender.Length;
         BinaryPrimitives.WriteUInt32LittleEndian(inbound.AsSpan(pos), 0); pos += 4;
-        BinaryPrimitives.WriteUInt32LittleEndian(inbound.AsSpan(pos), 0); pos += 4;
+        BinaryPrimitives.WriteSingleLittleEndian(inbound.AsSpan(pos), 60f); pos += 4;
+        BinaryPrimitives.WriteUInt32LittleEndian(inbound.AsSpan(pos), 0x0Bu); pos += 4;
 
         var parsed = HearSpeech.TryParse(inbound);
         Assert.NotNull(parsed);
         Assert.True(parsed!.Value.IsRanged);
+        Assert.Equal(60f, parsed.Value.Range);
+        Assert.Equal(0x0Bu, parsed.Value.ChatType);
     }
 
     [Fact]