feat(CT): CT2 — Runtime character-title ownership + wire

Campaign CT slice CT2: the client now learns the character's earned
titles and current display title from the server, owns that state in
Runtime, and can send a display-title change. No UI (CT3/CT4).

Wire (Core.Net):
- GameEvents.ParseCharacterTitleTable (0x0029 CharacterTitle): retail
  CharacterTitleTable::UnPack @0x005c6e90 skips a leading u32 into no
  field — its own Pack @0x005c6e40 always writes the literal 1 there,
  matching ACE's unconditional Writer.Write(1u) — then reads
  displayTitleId, then a count-prefixed PList<uint> of earned ids.
- GameEvents.ParseUpdateTitle (0x002B UpdateTitle): titleId +
  setAsDisplay, per CM_Social::DispatchUI_AddOrSetCharacterTitle
  @0x006a54c0 -> Handle_Social__AddOrSetCharacterTitle @0x00564260,
  which ALWAYS adds (SendNotice_AddCharacterTitle, unconditional) and
  additionally sets display only when setAsDisplay != 0
  (SendNotice_SetDisplayCharacterTitle, gated).
- SocialActions.BuildTitleSet / WorldSession.SendSetTitle: outbound
  TitleSet (0x002C), u32 titleId, matching ACE's GameActionSetTitle.
- GameEventWiring gains onCharacterTitleTable/onUpdateTitle delegate
  holes (Core.Net cannot reference AcDream.Runtime directly).

Runtime:
- New RuntimeCharacterTitleState (RuntimeCharacterState.Titles): earned
  title id set + display title id, TableReplaced/TitleAdded/
  DisplayTitleChanged events matching retail's unconditional-add /
  gated-display-set contract, clears at generation reset.
  RuntimeCharacterOwnershipSnapshot/CaptureOwnership/IsConverged and
  RuntimeCharacterSnapshot extended (trailing optional fields, no
  existing call site broken).
- IRuntimeCharacterCommands.SetTitle: generation-gated, sends
  TitleSet only — NO optimistic local mutation. Verified against
  retail's own CM_Social::Event_SetDisplayCharacterTitle @0x006a5720,
  which sends the wire message and touches no local field; the display
  title updates only from the server's own echo (the CA-campaign
  lesson: never re-add an optimistic write). Implemented on both hosts
  (DirectGameRuntimeCommandAdapter direct-send;
  CurrentGameRuntimeCommandAdapter via LiveCommandBus /
  LiveSessionCommandRouter's new SetTitleRuntimeCmd).
- LiveSessionEventRouter wires the two inbound events unconditionally
  (RuntimeCharacterState.Titles is a required child, not an optional
  sibling like Fellowship/Allegiance).

App (non-UI plumbing + resolver):
- CharacterTitleResolver (src/AcDream.App/UI/Layout/): ports
  CharacterTitleTable::GetCharacterTitleFromID @0x005c6ed0 — titleId ->
  EnumMapper(0x22000041) canonical key -> compute_str_hash ->
  StringTable(0x2300000E) localized text. Runtime stays id-only; CT3/
  CT4 consume this for display. DIDs hardcoded per the RetailKeyNames
  precedent (CT1 verified them end-to-end).

Register: no new row. Retail's send path is non-optimistic and so is
ours — no deviation to record for this slice.

Tests: wire conformance (byte-exact + truncation) in
CharacterTitleEventsTests.cs + SocialActionsTests.cs; Runtime owner
unit tests in RuntimeCharacterTitleStateTests.cs plus integration in
RuntimeCharacterStateTests.cs; a no-local-mutation command test in
DirectGameRuntimeCommandAdapterTests.cs; an InstalledDat pin
(CharacterTitleResolverLiveDatTests.cs, ids 0/1/2/3/5/13/14, run green
with ACDREAM_RUN_INSTALLED_DAT_TESTS=1). Full solution build green;
hermetic filtered suite green (15,380 passed / 0 failed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Core.Net/Messages/GameEvents.cs

@@ -869,6 +869,73 @@ public static class GameEvents
     public static FellowshipFellowStatsDone ParseFellowshipFellowStatsDone(ReadOnlySpan<byte> payload)
         => new(payload.Length >= 4 ? BinaryPrimitives.ReadUInt32LittleEndian(payload) : null);
 
+    // ── Character titles (Campaign CT slice CT2, 2026-08-24) ────────────────
+
+    /// <summary>
+    /// <c>0x0029 CharacterTitle</c> — retail <c>CharacterTitleTable::UnPack
+    /// @0x005c6e90</c> (named-retail pseudo-C offset 471514-471526). The
+    /// FIRST u32 is advanced past but never stored into any field — retail's
+    /// own <c>CharacterTitleTable::Pack @0x005c6e40</c> (offset 471494-471510)
+    /// always writes the literal constant <c>1</c> there
+    /// (<c>**(uint32_t**)arg2 = 1</c>), and ACE's
+    /// <c>GameEventCharacterTitle.cs</c> matches with an unconditional
+    /// <c>Writer.Write(1u)</c> — a version/format tag retail itself discards
+    /// on read, not meaningful gameplay data (CT2 task item 1). Then the
+    /// current display title id (<c>mDisplayTitle</c>), then the
+    /// count-prefixed <c>PList&lt;uint&gt;</c> of every earned title id
+    /// (<c>mTitleList</c>).
+    /// </summary>
+    public readonly record struct CharacterTitleTable(
+        uint DisplayTitleId,
+        IReadOnlyList<uint> TitleIds);
+
+    public static CharacterTitleTable? ParseCharacterTitleTable(ReadOnlySpan<byte> payload)
+    {
+        try
+        {
+            int pos = 0;
+            _ = FellowshipReadU32(payload, ref pos); // discarded pack-version tag — see doc comment above
+            uint displayTitleId = FellowshipReadU32(payload, ref pos);
+            uint count = FellowshipReadU32(payload, ref pos);
+            // PList<uint>::UnPack stores a 32-bit count bounded only by the
+            // remaining packet — same generous guard as
+            // SocialStateMessages.ParseFriendsUpdate.
+            if (count > 65_536) return null;
+            var titleIds = new uint[count];
+            for (int i = 0; i < titleIds.Length; i++)
+                titleIds[i] = FellowshipReadU32(payload, ref pos);
+            return new CharacterTitleTable(displayTitleId, titleIds);
+        }
+        catch (FormatException) { return null; }
+    }
+
+    /// <summary>
+    /// <c>0x002B UpdateTitle</c> — retail's dispatch entry
+    /// <c>CM_Social::DispatchUI_AddOrSetCharacterTitle @0x006a54c0</c> reads
+    /// exactly <c>titleId</c> then <c>setAsDisplay</c> and forwards to
+    /// <c>ClientUISystem::Handle_Social__AddOrSetCharacterTitle
+    /// @0x00564260</c>, which ALWAYS broadcasts
+    /// <c>SendNotice_AddCharacterTitle(titleId)</c> (a title just earned is
+    /// unconditionally added to the earned set) and, only when
+    /// <c>setAsDisplay != 0</c>, ALSO broadcasts
+    /// <c>SendNotice_SetDisplayCharacterTitle(titleId)</c>. ACE's
+    /// <c>GameEventUpdateTitle.cs</c>: <c>u32 title, u32
+    /// setAsDisplayTitle</c> — matches exactly.
+    /// </summary>
+    public readonly record struct UpdateTitle(uint TitleId, bool SetAsDisplay);
+
+    public static UpdateTitle? ParseUpdateTitle(ReadOnlySpan<byte> payload)
+    {
+        try
+        {
+            int pos = 0;
+            uint titleId = FellowshipReadU32(payload, ref pos);
+            bool setAsDisplay = FellowshipReadU32(payload, ref pos) != 0u;
+            return new UpdateTitle(titleId, setAsDisplay);
+        }
+        catch (FormatException) { return null; }
+    }
+
     private static FellowMember ReadFellow(ReadOnlySpan<byte> payload, ref int pos, uint guid)
     {
         uint cpCache = FellowshipReadU32(payload, ref pos);