fix(runtime): name why a placement is parked and fail closed when it cannot resolve

Fixes #284 (plan S1).

A first-entry placement that could not be prepared returned
RetrySetupUnavailable and was re-Advanced every pump forever. Nothing counted
it, nothing named its cause, and nothing distinguished "waiting for something
that will arrive" from "waiting for something that never can". That is why
#281's 43 test failures presented as four unrelated symptoms across App and
Runtime instead of one cause, and why a stuck entity in the live client simply
never appears with no log line to follow.

Worse, the two causes were conflated: 670f307c's missing-world-frame park
reported itself as RetrySetupUnavailable, sending anyone diagnosing it to the
prepared-asset pipeline rather than to the absent local-player Create that
actually publishes the frame.

- RetryWorldFrameUnavailable splits the two causes. Call sites now ask
  IsRetryable() instead of comparing against one reason, so a future retry
  reason cannot be silently reclassified as a hard rejection - the exact way
  this class of bug hides.
- The operation retains its RuntimeSetPositionParkReason, and
  RuntimeSetPositionOwnershipSnapshot reports parked work by cause
  (ParkedAwaitingSetupCollisionCount / ParkedAwaitingWorldFrameCount /
  ParkedPlacementCount), so parked placements appear wherever ledgers are
  already asserted.
- ObserveLocalPlayerCreate records the accepted local-player Create even when
  it carries no landblock - precisely the case where no frame is ever
  published - and ThrowIfWorldFrameUnreachable makes that contradiction
  terminal. Waiting is legitimate only while that Create is outstanding; after
  it, no later pump can supply the frame. Same shape as 01f4791e, which made a
  violated receipt-ledger invariant terminal rather than resumable.

This is observability plus fail-fast. There is no timeout, no retry cap, and
no grace period anywhere in it; retryable work still retries exactly as before
and no placement behaviour changed.

The parked counts are deliberately NOT folded into IsConverged: #277 documents
a far Create legitimately parking for a whole session, so a parked entry at
teardown is not automatically a defect. Wiring them into the connected gates
is carried with #277's service-window conversion, where "legitimately parked"
becomes definable.

Runtime 1,012/1,012. Complete Release solution: 10,834 passed / 4 skipped /
0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Runtime/Physics/RuntimeSetPositionMoverPreparation.cs

@@ -9,11 +9,72 @@ namespace AcDream.Runtime.Physics;
 internal enum RuntimeSetPositionMoverPreparationStatus
 {
     Prepared,
+
+    /// <summary>
+    /// The authored Setup collision payload has not been read yet. Resolves
+    /// when the prepared-asset read completes.
+    /// </summary>
     RetrySetupUnavailable,
+
+    /// <summary>
+    /// #284: Runtime's world frame is not published yet, so a landblock-local
+    /// Create origin cannot be converted
+    /// (<see cref="RuntimePhysicsState.TryGetWorldFrameOffset"/>). Previously
+    /// this reported itself as <see cref="RetrySetupUnavailable"/>, which sent
+    /// anyone diagnosing a parked placement to the asset pipeline instead of
+    /// the missing local-player Create that actually publishes the frame.
+    /// Retryable exactly like Setup - only the reason differs.
+    /// </summary>
+    RetryWorldFrameUnavailable,
+
     RejectedAuthority,
     InvalidData,
 }
 
+internal static class RuntimeSetPositionMoverPreparationStatusExtensions
+{
+    /// <summary>
+    /// True for the statuses whose work can still succeed on a later pump.
+    /// Call sites must use this rather than comparing against one reason, so
+    /// a newly added retry reason cannot be silently treated as a rejection.
+    /// </summary>
+    internal static bool IsRetryable(
+        this RuntimeSetPositionMoverPreparationStatus status) =>
+        status is RuntimeSetPositionMoverPreparationStatus
+                .RetrySetupUnavailable
+            or RuntimeSetPositionMoverPreparationStatus
+                .RetryWorldFrameUnavailable;
+
+    /// <summary>
+    /// The parked-placement reason a retryable status contributes to the
+    /// ownership ledger, or <see cref="RuntimeSetPositionParkReason.None"/>
+    /// when the status is not a park.
+    /// </summary>
+    internal static RuntimeSetPositionParkReason ParkReason(
+        this RuntimeSetPositionMoverPreparationStatus status) =>
+        status switch
+        {
+            RuntimeSetPositionMoverPreparationStatus.RetrySetupUnavailable =>
+                RuntimeSetPositionParkReason.AwaitingSetupCollision,
+            RuntimeSetPositionMoverPreparationStatus
+                .RetryWorldFrameUnavailable =>
+                RuntimeSetPositionParkReason.AwaitingWorldFrame,
+            _ => RuntimeSetPositionParkReason.None,
+        };
+}
+
+/// <summary>
+/// #284: why a first-entry placement is currently parked. Retained on the
+/// operation so <c>CaptureOwnership</c> can report parked work by cause
+/// instead of leaving it invisible until a downstream symptom appears.
+/// </summary>
+internal enum RuntimeSetPositionParkReason
+{
+    None,
+    AwaitingSetupCollision,
+    AwaitingWorldFrame,
+}
+
 /// <summary>
 /// Distinguishes a Setup payload which has not arrived yet from a completed
 /// lookup whose result is absent. Retail supplies its dummy placement sphere