feat(CT): CT2 — Runtime character-title ownership + wire

Campaign CT slice CT2: the client now learns the character's earned
titles and current display title from the server, owns that state in
Runtime, and can send a display-title change. No UI (CT3/CT4).

Wire (Core.Net):
- GameEvents.ParseCharacterTitleTable (0x0029 CharacterTitle): retail
  CharacterTitleTable::UnPack @0x005c6e90 skips a leading u32 into no
  field — its own Pack @0x005c6e40 always writes the literal 1 there,
  matching ACE's unconditional Writer.Write(1u) — then reads
  displayTitleId, then a count-prefixed PList<uint> of earned ids.
- GameEvents.ParseUpdateTitle (0x002B UpdateTitle): titleId +
  setAsDisplay, per CM_Social::DispatchUI_AddOrSetCharacterTitle
  @0x006a54c0 -> Handle_Social__AddOrSetCharacterTitle @0x00564260,
  which ALWAYS adds (SendNotice_AddCharacterTitle, unconditional) and
  additionally sets display only when setAsDisplay != 0
  (SendNotice_SetDisplayCharacterTitle, gated).
- SocialActions.BuildTitleSet / WorldSession.SendSetTitle: outbound
  TitleSet (0x002C), u32 titleId, matching ACE's GameActionSetTitle.
- GameEventWiring gains onCharacterTitleTable/onUpdateTitle delegate
  holes (Core.Net cannot reference AcDream.Runtime directly).

Runtime:
- New RuntimeCharacterTitleState (RuntimeCharacterState.Titles): earned
  title id set + display title id, TableReplaced/TitleAdded/
  DisplayTitleChanged events matching retail's unconditional-add /
  gated-display-set contract, clears at generation reset.
  RuntimeCharacterOwnershipSnapshot/CaptureOwnership/IsConverged and
  RuntimeCharacterSnapshot extended (trailing optional fields, no
  existing call site broken).
- IRuntimeCharacterCommands.SetTitle: generation-gated, sends
  TitleSet only — NO optimistic local mutation. Verified against
  retail's own CM_Social::Event_SetDisplayCharacterTitle @0x006a5720,
  which sends the wire message and touches no local field; the display
  title updates only from the server's own echo (the CA-campaign
  lesson: never re-add an optimistic write). Implemented on both hosts
  (DirectGameRuntimeCommandAdapter direct-send;
  CurrentGameRuntimeCommandAdapter via LiveCommandBus /
  LiveSessionCommandRouter's new SetTitleRuntimeCmd).
- LiveSessionEventRouter wires the two inbound events unconditionally
  (RuntimeCharacterState.Titles is a required child, not an optional
  sibling like Fellowship/Allegiance).

App (non-UI plumbing + resolver):
- CharacterTitleResolver (src/AcDream.App/UI/Layout/): ports
  CharacterTitleTable::GetCharacterTitleFromID @0x005c6ed0 — titleId ->
  EnumMapper(0x22000041) canonical key -> compute_str_hash ->
  StringTable(0x2300000E) localized text. Runtime stays id-only; CT3/
  CT4 consume this for display. DIDs hardcoded per the RetailKeyNames
  precedent (CT1 verified them end-to-end).

Register: no new row. Retail's send path is non-optimistic and so is
ours — no deviation to record for this slice.

Tests: wire conformance (byte-exact + truncation) in
CharacterTitleEventsTests.cs + SocialActionsTests.cs; Runtime owner
unit tests in RuntimeCharacterTitleStateTests.cs plus integration in
RuntimeCharacterStateTests.cs; a no-local-mutation command test in
DirectGameRuntimeCommandAdapterTests.cs; an InstalledDat pin
(CharacterTitleResolverLiveDatTests.cs, ids 0/1/2/3/5/13/14, run green
with ACDREAM_RUN_INSTALLED_DAT_TESTS=1). Full solution build green;
hermetic filtered suite green (15,380 passed / 0 failed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/plans/2026-08-24-character-panel-parity-campaign.md

@@ -110,8 +110,9 @@ the composing function verbatim before writing a line of C#.
   0x10000539`); pages currently show retail-authored closed visuals.
 - Header labels partially bound (`StatHeaderLine` + `PkStatus` seams
   exist in `CharacterStatController.Bind` — content contract wrong).
-- `GameEventType.CharacterTitle/UpdateTitle` enum entries exist; no
-  parser, no state owner, no outbound builder.
+- `GameEventType.CharacterTitle/UpdateTitle` enum entries exist and now
+  (CT2, landed) have a parser, a `RuntimeCharacterTitleState` owner, and
+  an outbound `TitleSet` builder — see CT2's paragraph below.
 - The character window registers with `DatConstraintSource` — authored
   min/max plumbing exists in `RetailWindowFrame`; Y-resize for this
   window and the list-scrollbar contract do not.
@@ -145,13 +146,37 @@ rows), the value-column right margin, header element fonts/colors
 min/max constraints. Output: research doc + InstalledDat pins (the
 tooltip/scrollbar-pin pattern). No production changes.
 
-**CT2 — Runtime title ownership + wire.** Parse `0x0029`/`0x002B`;
-locate the DAT title-string table `GetCharacterTitleFromID` reads and
-port the lookup; `RuntimeCharacterState` owns the title set + display
-title (J4.3 owner; clears at generation reset); outbound `TitleSet`
-builder behind a typed Runtime command; ordered change events for UI
-and headless bots (#368 contract: hosts observe the same owner).
-Conformance tests against ACE's writer shapes.
+**CT2 — Runtime title ownership + wire. LANDED 2026-08-24.** Parsed
+`0x0029 CharacterTitle` (retail's `CharacterTitleTable::UnPack
+@0x005c6e90` — the leading ACE `1u`/retail-Pack-constant field is
+discarded, matching retail's own read) and `0x002B UpdateTitle`
+(`CM_Social::DispatchUI_AddOrSetCharacterTitle @0x006a54c0`: title id +
+setAsDisplay). New sibling owner `RuntimeCharacterTitleState`
+(`RuntimeCharacterState.Titles`) holds the earned-title set + display
+title id, clears at generation reset (`CaptureOwnership`/`IsConverged`
+extended with `TitleCount`/`DisplayTitleIsDefault`), and fires
+`TableReplaced`/`TitleAdded`/`DisplayTitleChanged` — matching retail's
+own unconditional-add / gated-display-set contract
+(`Handle_Social__AddOrSetCharacterTitle @0x00564260`). Outbound
+`TitleSet (0x002C)` ships behind `IRuntimeCharacterCommands.SetTitle`
+on both hosts (`DirectGameRuntimeCommandAdapter` direct-send,
+`CurrentGameRuntimeCommandAdapter` via the `LiveCommandBus`/
+`LiveSessionCommandRouter` queue) with **NO optimistic local
+mutation** — verified against retail's own
+`CM_Social::Event_SetDisplayCharacterTitle @0x006a5720`, which sends
+the wire message and touches no local field; the display title updates
+only from the server's own echo. No register row: this slice
+introduces no retail deviation. App-layer `CharacterTitleResolver`
+(`src/AcDream.App/UI/Layout/CharacterTitleResolver.cs`) ports
+`GetCharacterTitleFromID`'s EnumMapper(`0x22000041`) → hash →
+StringTable(`0x2300000E`) chain for CT3/CT4 to consume; Runtime stays
+id-only. Conformance tests against ACE's writer shapes
+(`tests/AcDream.Core.Net.Tests/Messages/CharacterTitleEventsTests.cs`),
+Runtime owner tests (`RuntimeCharacterTitleStateTests.cs` +
+`RuntimeCharacterStateTests.cs` integration), a no-local-mutation
+command test (`DirectGameRuntimeCommandAdapterTests.cs`), and an
+InstalledDat pin (`CharacterTitleResolverLiveDatTests.cs`, ids 0/1/2/3/
+5/13/14) all pass.
 
 **CT3 — Titles page UI.** Bind the authored page through the standard
 GUI classes (`UiTemplateListBox`/`UiScrollbar`/`UiButton` — zero