fix #435 (part 2, closes it): attribute the unowned probes — delete 7, reclassify 8, restore 1

Part 1 deleted probes whose owning issues were closed. These 14 named no
issue at all, so each was traced to its introducing commit
(git log -S) instead of guessed at. Attribution split them three ways:

DELETED (7, investigations closed): ACDREAM_A8_DUMP_PV and
ACDREAM_DUMP_LIVE_SPAWNS (Phase A8), ACDREAM_DUMP_CLOTHING (#37),
ACDREAM_DUMP_EDGE_SLIDE (#32), ACDREAM_DUMP_STEPUP (L.2.3d-f),
ACDREAM_DUMP_VENDOR (the vendor campaign, 25 call sites across 8 files),
ACDREAM_DUMP_VITALS (#5, four independent read sites). VendorDiagnostics.cs
went entirely.

RECLASSIFIED (8, tools misfiled as probes): the DUMP_CELLS/DUMP_GFXOBJS
fixture-extraction family (replay-harness tooling with a roundtrip test),
PROBE_CELL (standing cell-transit tracer, pair of the permanent
PROBE_RESOLVE), DUMP_SKY and HIDE_PART (generic isolation tools), and
DUMP_STEEP_ROOF — which looked like an L.4 relic but observes LIVE
divergence-register row AD-56; deleting it would have removed the only
runtime lens on an active divergence. All moved to Permanent diagnostics
with their attribution recorded.

RESTORED (1): ACDREAM_DUMP_MOVE_TRUTH was deleted and un-deleted the same
day. It is not a probe — the canonical nine-stop soak
(run-connected-r6-soak.ps1) hard-fails every destination without its
'move-truth OUT' records, with a message that would misdirect the next
operator. Under the no-workarounds rule the gate's mechanism is restored,
not left broken with an IOU (#437, closed). Process lesson recorded on
both issues: a closed owning issue is NOT sufficient to delete a probe —
grep tools/ and the contract tests for consumers first.

Also lands the owner-requested default-off invariant: every diagnostic in
the codebase is inert until its env var is explicitly set. Exactly four
flags default ON and none is a diagnostic — RETAIL_CHASE, CAMERA_COLLIDE,
CAMERA_ALIGN_SLOPE, RETAIL_CLOSE_DEGRADES are retail behaviors wearing an
A/B off-switch. That set is now FROZEN by
LaunchOptionsDocumentationTests.OnlyTheFourRetailBehaviorFlagsDefaultOn;
docs/launch-options.md's Conventions and CLAUDE.md state the rule, and
CLAUDE.md now binds future probes to a documented row in the same commit.

The client reads 137 environment variables (161 at audit start); 40
temporary probes remain, every one attributed. Full hermetic suite 15,322
passed / 0 failed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -1572,12 +1572,21 @@ Every environment variable and command-line argument the client reads —
 what it does, its exact value shape, and **what else it changes about the
 run** — is documented in
 [`docs/launch-options.md`](docs/launch-options.md). That file is the single
-source of truth and is enforced by `LaunchOptionsDocumentationTests`: a
-flag without a documented row fails the build, and so does a documented row
-whose read site was deleted.
+source of truth for every probe we have and how to turn one on, and it is
+enforced by `LaunchOptionsDocumentationTests`: a flag without a documented
+row fails the build, and so does a documented row whose read site was
+deleted. **Any future probe that stays in the code gets its row there in
+the same commit — no exceptions.**
 
-Two habits that list exists to enforce:
+The binding rules:
 
+- **Every probe and dump is OFF by default.** Nothing that prints, records,
+  or costs performance may activate without its env var explicitly set
+  (`=1`). The only default-on flags are retail *behaviors* wearing an
+  A/B off-switch (`ACDREAM_RETAIL_CHASE`, `ACDREAM_CAMERA_COLLIDE`,
+  `ACDREAM_CAMERA_ALIGN_SLOPE`, `ACDREAM_RETAIL_CLOSE_DEGRADES` — `=0`
+  disables); that set is frozen by `LaunchOptionsDocumentationTests` —
+  never add a default-on diagnostic.
 - **Read the side-effects column before any measurement.** Flags that look
   inert are not: `ACDREAM_AUTOMATION_ARTIFACT_DIR` also builds a per-frame
   diagnostics referee (#432), and `ACDREAM_STREAM_RADIUS` measures a