feat(CT): CT2 — Runtime character-title ownership + wire

Campaign CT slice CT2: the client now learns the character's earned
titles and current display title from the server, owns that state in
Runtime, and can send a display-title change. No UI (CT3/CT4).

Wire (Core.Net):
- GameEvents.ParseCharacterTitleTable (0x0029 CharacterTitle): retail
  CharacterTitleTable::UnPack @0x005c6e90 skips a leading u32 into no
  field — its own Pack @0x005c6e40 always writes the literal 1 there,
  matching ACE's unconditional Writer.Write(1u) — then reads
  displayTitleId, then a count-prefixed PList<uint> of earned ids.
- GameEvents.ParseUpdateTitle (0x002B UpdateTitle): titleId +
  setAsDisplay, per CM_Social::DispatchUI_AddOrSetCharacterTitle
  @0x006a54c0 -> Handle_Social__AddOrSetCharacterTitle @0x00564260,
  which ALWAYS adds (SendNotice_AddCharacterTitle, unconditional) and
  additionally sets display only when setAsDisplay != 0
  (SendNotice_SetDisplayCharacterTitle, gated).
- SocialActions.BuildTitleSet / WorldSession.SendSetTitle: outbound
  TitleSet (0x002C), u32 titleId, matching ACE's GameActionSetTitle.
- GameEventWiring gains onCharacterTitleTable/onUpdateTitle delegate
  holes (Core.Net cannot reference AcDream.Runtime directly).

Runtime:
- New RuntimeCharacterTitleState (RuntimeCharacterState.Titles): earned
  title id set + display title id, TableReplaced/TitleAdded/
  DisplayTitleChanged events matching retail's unconditional-add /
  gated-display-set contract, clears at generation reset.
  RuntimeCharacterOwnershipSnapshot/CaptureOwnership/IsConverged and
  RuntimeCharacterSnapshot extended (trailing optional fields, no
  existing call site broken).
- IRuntimeCharacterCommands.SetTitle: generation-gated, sends
  TitleSet only — NO optimistic local mutation. Verified against
  retail's own CM_Social::Event_SetDisplayCharacterTitle @0x006a5720,
  which sends the wire message and touches no local field; the display
  title updates only from the server's own echo (the CA-campaign
  lesson: never re-add an optimistic write). Implemented on both hosts
  (DirectGameRuntimeCommandAdapter direct-send;
  CurrentGameRuntimeCommandAdapter via LiveCommandBus /
  LiveSessionCommandRouter's new SetTitleRuntimeCmd).
- LiveSessionEventRouter wires the two inbound events unconditionally
  (RuntimeCharacterState.Titles is a required child, not an optional
  sibling like Fellowship/Allegiance).

App (non-UI plumbing + resolver):
- CharacterTitleResolver (src/AcDream.App/UI/Layout/): ports
  CharacterTitleTable::GetCharacterTitleFromID @0x005c6ed0 — titleId ->
  EnumMapper(0x22000041) canonical key -> compute_str_hash ->
  StringTable(0x2300000E) localized text. Runtime stays id-only; CT3/
  CT4 consume this for display. DIDs hardcoded per the RetailKeyNames
  precedent (CT1 verified them end-to-end).

Register: no new row. Retail's send path is non-optimistic and so is
ours — no deviation to record for this slice.

Tests: wire conformance (byte-exact + truncation) in
CharacterTitleEventsTests.cs + SocialActionsTests.cs; Runtime owner
unit tests in RuntimeCharacterTitleStateTests.cs plus integration in
RuntimeCharacterStateTests.cs; a no-local-mutation command test in
DirectGameRuntimeCommandAdapterTests.cs; an InstalledDat pin
(CharacterTitleResolverLiveDatTests.cs, ids 0/1/2/3/5/13/14, run green
with ACDREAM_RUN_INSTALLED_DAT_TESTS=1). Full solution build green;
hermetic filtered suite green (15,380 passed / 0 failed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/UI/Layout/CharacterTitleResolver.cs

@@ -0,0 +1,85 @@
+using AcDream.Content;
+using DatReaderWriter.DBObjs;
+
+namespace AcDream.App.UI.Layout;
+
+/// <summary>
+/// Ports <c>CharacterTitleTable::GetCharacterTitleFromID @0x005c6ed0</c>'s
+/// title id -&gt; display string chain: <c>EnumMapper(0x22000041)</c>
+/// canonical key name -&gt; <c>compute_str_hash</c> -&gt;
+/// <c>StringTable(0x2300000E)</c> localized text.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Retail's chain is a two-level <c>DBObj::GetDIDByEnum</c> indirection
+/// through a master map (DID <c>0x25000000</c>): category 1 (EMAPPER) for
+/// the EnumMapper, category 4 (STRINGTABLE) for the StringTable. Both
+/// resolved DIDs are hardcoded here rather than porting the indirection
+/// generically — the same precedent <see cref="RetailKeyNames"/> already
+/// set for this exact category-4 family (its <c>KeyNameTableId</c>/
+/// <c>MetaKeyNameTableId</c>/<c>DelimiterTableId</c>); factor out a shared
+/// helper only if a THIRD consumer of <c>GetDIDByEnum</c> appears. Both DIDs
+/// were verified end-to-end against ACE's <c>CharacterTitle.WarMage = 13</c>
+/// in Campaign CT slice CT1
+/// (docs/research/2026-08-24-campaign-ct-dat-ground-truth.md §5, pinned by
+/// <c>CharacterPanelLiveDatTests.TitleStringTable_ResolvesWarMageEndToEnd</c>).
+/// </para>
+/// <para>
+/// <see cref="AcDream.Runtime.Gameplay.RuntimeCharacterTitleState"/> stays
+/// id-only (the #368 headless-bot-observes-the-same-owner contract); this
+/// resolver is the App-layer seam CT3 (Titles page) and CT4 (header
+/// identity line) consume for display strings.
+/// </para>
+/// </remarks>
+public sealed class CharacterTitleResolver
+{
+    /// <summary>EnumMapper DID — title id -&gt; canonical key name (e.g.
+    /// "ID_CharacterTitle_War_Mage").</summary>
+    public const uint TitleEnumMapperId = 0x22000041u;
+
+    /// <summary>StringTable DID — canonical key hash -&gt; localized text.</summary>
+    public const uint TitleStringTableId = 0x2300000Eu;
+
+    private readonly IDatReaderWriter _dats;
+    private readonly DatStringResolver _strings;
+    private EnumMapper? _titleEnumMapper;
+    private bool _loadedMapper;
+
+    public CharacterTitleResolver(IDatReaderWriter dats)
+    {
+        _dats = dats ?? throw new ArgumentNullException(nameof(dats));
+        _strings = new DatStringResolver(dats);
+    }
+
+    /// <summary>
+    /// Resolves one title id to its localized display string. Returns null
+    /// for id 0 (retail's own early-return in
+    /// <c>GetCharacterTitleFromID</c>), an id absent from the EnumMapper, or
+    /// an unlocalized string — matching
+    /// <see cref="DatStringResolver.Resolve(uint, uint, int)"/>'s own
+    /// null-on-miss contract.
+    /// </summary>
+    public string? Resolve(uint titleId)
+    {
+        if (titleId == 0u)
+            return null;
+
+        if (!_loadedMapper)
+        {
+            _dats.Portal.TryGet<EnumMapper>(TitleEnumMapperId, out _titleEnumMapper);
+            _loadedMapper = true;
+        }
+
+        if (_titleEnumMapper is null
+            || !_titleEnumMapper.IdToStringMap.TryGetValue(titleId, out var rawNameValue))
+        {
+            return null;
+        }
+
+        string rawName = rawNameValue.ToString();
+        if (string.IsNullOrEmpty(rawName))
+            return null;
+
+        return _strings.Resolve(TitleStringTableId, DatStringResolver.ComputeHash(rawName));
+    }
+}