feat(content): S1 exact CellStruct surface-index construction, recipe 8

Campaign OVERHAUL S1 chunk A. Retail's D3DPolyRender::ConstructMesh
@0x0059DFA0 is ported as one pure Core descriptor plus the Content
extraction that consumes it:

- side candidates come only from sides_type (0/1/2); NoPos/NoNeg mean
  UV-array absence only and never suppress a side (CPolygon::UnPack
  @0x00538650);
- ST_DOUBLE's second copy is reversed with a negative normal; ST_BOTH's
  negative side has a negative normal and forward fan order (reverse is on
  the copy ordinal, not the side ordinal);
- an absent UV-index array is UV index 0 (ConstructMesh @0x0059E691
  xor ebx,ebx, arbitrated on the PDB-paired binary); copyVert @0x0059C080
  zeroes coordinates only for a negative or out-of-range index or a vertex
  without UVs, never by clamping to slot 0;
- the subset owner is the source surface-array index, emitted in ascending
  slot order with retail's per-slot mask (2 > 8 > 4 precedence, positive
  surface OR on signed stippling > 0);
- built-EnvCell admission is (Surface.Type & (BASE1_IMAGE|BASE1_CLIPMAP))
  != 0 after surface resolution (DrawEnvCell @0x0059F170 -> DrawMesh
  @0x0059D4A0 arg4=1); untextured slots are constructed but not emitted;
- cell batches carry SourceSurfaceIndex, RetailSurfaceMask, RawSurfaceType,
  IsCellShell, and fixed clockwise raster cull (RenderMeshSubset
  @0x0059CA10); authored sides_type is no longer stored as GPU cull.

Prepared-mesh serializer gains the four fields; bake recipe 7 -> 8 with a
FullRebuild migration; pak format stays 2 (pinned). Ordinary GfxObj
extraction is unchanged. AP-234's register row and CellMesh unification
land in chunk B.

Core: 32 descriptor tests. Content: 170/170. Bake: 18/18. Launcher.Core:
365/365 (Lane!=Linux). Solution Release build 0 warnings / 0 errors.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/AcDream.Content.Tests/PakFormatTests.cs

@@ -9,6 +9,18 @@ public class PakFormatTests {
         Assert.Equal(64, PakHeader.Size);
     }
 
+    /// <summary>
+    /// OH2/S1 contract §8.3 point 5: the recipe 7 -&gt; 8 bump (exact
+    /// CellStruct surface-index subset construction) is a serialized
+    /// PAYLOAD/recipe change, not a container framing change — this pin
+    /// makes that decision explicit and test-visible rather than implicit.
+    /// </summary>
+    [Fact]
+    public void FormatVersion_StaysAtTwo_AcrossTheOH2RecipeBump() {
+        Assert.Equal(2u, PakFormat.CurrentFormatVersion);
+        Assert.Equal(8u, PakFormat.CurrentBakeToolVersion);
+    }
+
     [Fact]
     public void TocEntry_Size_Is24Bytes() {
         Assert.Equal(24, PakTocEntry.Size);