feat(content): S1 exact CellStruct surface-index construction, recipe 8

Campaign OVERHAUL S1 chunk A. Retail's D3DPolyRender::ConstructMesh
@0x0059DFA0 is ported as one pure Core descriptor plus the Content
extraction that consumes it:

- side candidates come only from sides_type (0/1/2); NoPos/NoNeg mean
  UV-array absence only and never suppress a side (CPolygon::UnPack
  @0x00538650);
- ST_DOUBLE's second copy is reversed with a negative normal; ST_BOTH's
  negative side has a negative normal and forward fan order (reverse is on
  the copy ordinal, not the side ordinal);
- an absent UV-index array is UV index 0 (ConstructMesh @0x0059E691
  xor ebx,ebx, arbitrated on the PDB-paired binary); copyVert @0x0059C080
  zeroes coordinates only for a negative or out-of-range index or a vertex
  without UVs, never by clamping to slot 0;
- the subset owner is the source surface-array index, emitted in ascending
  slot order with retail's per-slot mask (2 > 8 > 4 precedence, positive
  surface OR on signed stippling > 0);
- built-EnvCell admission is (Surface.Type & (BASE1_IMAGE|BASE1_CLIPMAP))
  != 0 after surface resolution (DrawEnvCell @0x0059F170 -> DrawMesh
  @0x0059D4A0 arg4=1); untextured slots are constructed but not emitted;
- cell batches carry SourceSurfaceIndex, RetailSurfaceMask, RawSurfaceType,
  IsCellShell, and fixed clockwise raster cull (RenderMeshSubset
  @0x0059CA10); authored sides_type is no longer stored as GPU cull.

Prepared-mesh serializer gains the four fields; bake recipe 7 -> 8 with a
FullRebuild migration; pak format stays 2 (pinned). Ordinary GfxObj
extraction is unchanged. AP-234's register row and CellMesh unification
land in chunk B.

Core: 32 descriptor tests. Content: 170/170. Bake: 18/18. Launcher.Core:
365/365 (Lane!=Linux). Solution Release build 0 warnings / 0 errors.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/AcDream.Content.Tests/PreparedAssetSourceTests.cs

@@ -135,6 +135,42 @@ public sealed class PreparedAssetSourceTests : IDisposable
         }
     }
 
+    /// <summary>
+    /// OH2/S1 contract §10.5: an OLDER-recipe (7) package must be rejected
+    /// by a CURRENT-recipe (8) consumer through the catalog-identity check
+    /// alone, BEFORE any TextureBatchData payload field is ever
+    /// deserialized -- so an older pak can never be silently misread as
+    /// carrying the new SourceSurfaceIndex/RetailSurfaceMask/RawSurfaceType/
+    /// IsCellShell fields.
+    /// </summary>
+    [Fact]
+    public void Constructor_RejectsOlderRecipePackageBeforePayloadDecode()
+    {
+        // PakWriter stamps BakeToolVersion to PakFormat.CurrentBakeToolVersion
+        // unconditionally (the header-template default-0 footgun guard), so
+        // an "older recipe" file has to be produced by patching the on-disk
+        // header dword directly -- the same technique
+        // PakRoundTripTests.Reader_RejectsWrongFormatVersion uses for the
+        // sibling FormatVersion field. BakeToolVersion is offset 36 per
+        // PakHeader's normative layout.
+        string path = WritePak(
+            (PakAssetType.EnvCellMesh, 1u, Mesh(1u)));
+
+        using (var fs = new FileStream(path, FileMode.Open, FileAccess.ReadWrite))
+        {
+            fs.Position = 36;
+            Span<byte> buf = stackalloc byte[4];
+            System.Buffers.Binary.BinaryPrimitives.WriteUInt32LittleEndian(
+                buf, PakFormat.CurrentBakeToolVersion - 1);
+            fs.Write(buf);
+        }
+
+        InvalidDataException error = Assert.Throws<InvalidDataException>(
+            () => new PakPreparedAssetSource(path, Identity));
+        Assert.Contains("does not match the installed DAT set", error.Message);
+        Assert.Contains("Re-bake", error.Message);
+    }
+
     [Fact]
     public void Read_PreCanceledTokenPropagatesWithoutStartingRead()
     {