fix(ui): systemic escape normalization at the string source

The exit-world confirmation (ID_Client_EndCharacterSessionConfirm, table
0x23000001 key 0x0EB1C41D) rendered its literal two-character "\n" escapes
because escape decoding lived in individual consumers — Batch E centralized
it for authored captions only (DatWidgetFactory.ResolveAuthoredString), and
each new string surface had to remember its own copy. The installed DAT
carries the escape in 4,365 of 7,050 strings; per-consumer normalization
was structurally guaranteed to keep leaking.

Retail's placement is the SOURCE, not the widget: every public StringInfo
resolution ends in StringTableMetaLanguage::UnescapeString @ 0x0067BDC0
(StringInfo::InqString @ 0x0042E490, GetLiteralValue @ 0x0042CA50), the
write side escapes (SetLiteralValue @ 0x0042C980; AddVariable_String
@ 0x0042E6C0 for template variables), and widgets receive decoded text.
Ported exactly:

- NEW RetailStringEscapes: UnescapeString/EscapeString + the
  GetUnEscapedChar @ 0x0067B750 / GetEscapedChar @ 0x0067B6C0 tables
  (\n \t \r \q + the ten metalanguage self-escapes []!{}#\|^$,
  byte-verified against the PDB-paired 2013 binary at 0x3FE178;
  unrecognized pairs stay verbatim).
- DatStringResolver.Resolve/ResolveAll unescape at the source;
  ResolveTemplate escapes each variable on insert and unescapes the
  composed whole — retail's round trip, so variable content (player
  names) can never be corrupted by the final decode.
- RETIRED the consumer copies (double paths would corrupt an authored
  "\n" into a line break): DatWidgetFactory.NormalizeEscapes + BuildText's
  inline replace, RetailUiRuntime.NormalizeRetailNewlines + the
  OpenCaptureInstructions inline replace, DatRichText.Compose's replace,
  IndicatorDetailText.Shape's replace. ItemAppraisalTextLayout's replace
  stays — WIRE-domain (server strings never pass the DAT source; retail's
  ItemExamineUI::AddItemInfo @ 0x004AC050 appends wire text verbatim), now
  documented as such.
- Consumer CR-strips retired with them: the installed DATs contain ZERO
  real CR characters (sweep-measured) and UiText.WrapWords already drops
  strays.

Tests: RetailStringEscapes conformance (escape set, unknown pairs,
round trip), DatStringResolver source-decode pins (including the exact
user-reported exit-world text shape and a backslash-carrying variable),
the installed-DAT escape sweep (7,050 strings; every resolution must equal
the retail unescape of the raw entry; inventory printed), and the existing
caption/rich-text/live-DAT pins relocated to the source contract.

App 5550/3 (live-DAT), Runtime 1747/0, complete Release solution green
across all suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.App.Tests/UI/Layout/DatStringResolverTemplateTests.cs

@@ -85,6 +85,72 @@ public sealed class DatStringResolverTemplateTests
                 new Dictionary<uint, string>()));
     }
 
+    /// <summary>
+    /// The 2026-08-17 systemic escape round: resolution decodes the DAT's
+    /// literal two-character escapes AT THE SOURCE — retail's own placement
+    /// (<c>StringInfo::InqString @ 0x0042E490</c>'s unconditional
+    /// <c>UnescapeString</c> tail). Consumers receive real line breaks; no
+    /// per-consumer normalize remains.
+    /// </summary>
+    [Fact]
+    public void ResolveDecodesEscapesAtTheSource()
+    {
+        var resolver = MakeResolver(
+            "ID_Confirm_Exit",
+            fragments: [
+                "This will exit your character from the game world.\\n\\nAre you sure?",
+            ],
+            variables: []);
+
+        Assert.Equal(
+            "This will exit your character from the game world.\n\nAre you sure?",
+            resolver.Resolve(
+                TableId, DatStringResolver.ComputeHash("ID_Confirm_Exit")));
+    }
+
+    [Fact]
+    public void ResolveAllDecodesEveryVariant()
+    {
+        var resolver = MakeResolver(
+            "ID_Variants",
+            fragments: ["one\\nline", "two\\tcol"],
+            variables: []);
+
+        Assert.Equal(
+            ["one\nline", "two\tcol"],
+            resolver.ResolveAll(
+                TableId, DatStringResolver.ComputeHash("ID_Variants")));
+    }
+
+    /// <summary>
+    /// Template composition decodes the authored fragments' escapes while
+    /// variable content round-trips VERBATIM — retail escapes each variable
+    /// on insert (<c>AddVariable_String @ 0x0042E6C0</c> →
+    /// <c>SetLiteralValue(escape=1) @ 0x0042C980</c>) and unescapes the
+    /// composed whole once, so a player name containing escape-significant
+    /// characters can never be corrupted by the final decode.
+    /// </summary>
+    [Fact]
+    public void ResolveTemplateDecodesFragmentsAndKeepsVariablesVerbatim()
+    {
+        var resolver = MakeResolver(
+            "ID_Delete_Confirmation",
+            fragments: ["Delete ", "?\\nType 'DELETE' to confirm."],
+            variables: [DatStringResolver.PlayerVariable]);
+
+        Assert.Equal(
+            "Delete Odd\\nName?\nType 'DELETE' to confirm.",
+            resolver.ResolveTemplate(
+                TableId,
+                "ID_Delete_Confirmation",
+                new Dictionary<uint, string>
+                {
+                    // A pathological name carrying a REAL backslash before
+                    // an 'n' — must come out verbatim, not as a line break.
+                    [DatStringResolver.PlayerVariable] = "Odd\\nName",
+                }));
+    }
+
     [Fact]
     public void UnknownKeyResolvesNull()
     {