fix #435 (part 2, closes it): attribute the unowned probes — delete 7, reclassify 8, restore 1

Part 1 deleted probes whose owning issues were closed. These 14 named no
issue at all, so each was traced to its introducing commit
(git log -S) instead of guessed at. Attribution split them three ways:

DELETED (7, investigations closed): ACDREAM_A8_DUMP_PV and
ACDREAM_DUMP_LIVE_SPAWNS (Phase A8), ACDREAM_DUMP_CLOTHING (#37),
ACDREAM_DUMP_EDGE_SLIDE (#32), ACDREAM_DUMP_STEPUP (L.2.3d-f),
ACDREAM_DUMP_VENDOR (the vendor campaign, 25 call sites across 8 files),
ACDREAM_DUMP_VITALS (#5, four independent read sites). VendorDiagnostics.cs
went entirely.

RECLASSIFIED (8, tools misfiled as probes): the DUMP_CELLS/DUMP_GFXOBJS
fixture-extraction family (replay-harness tooling with a roundtrip test),
PROBE_CELL (standing cell-transit tracer, pair of the permanent
PROBE_RESOLVE), DUMP_SKY and HIDE_PART (generic isolation tools), and
DUMP_STEEP_ROOF — which looked like an L.4 relic but observes LIVE
divergence-register row AD-56; deleting it would have removed the only
runtime lens on an active divergence. All moved to Permanent diagnostics
with their attribution recorded.

RESTORED (1): ACDREAM_DUMP_MOVE_TRUTH was deleted and un-deleted the same
day. It is not a probe — the canonical nine-stop soak
(run-connected-r6-soak.ps1) hard-fails every destination without its
'move-truth OUT' records, with a message that would misdirect the next
operator. Under the no-workarounds rule the gate's mechanism is restored,
not left broken with an IOU (#437, closed). Process lesson recorded on
both issues: a closed owning issue is NOT sufficient to delete a probe —
grep tools/ and the contract tests for consumers first.

Also lands the owner-requested default-off invariant: every diagnostic in
the codebase is inert until its env var is explicitly set. Exactly four
flags default ON and none is a diagnostic — RETAIL_CHASE, CAMERA_COLLIDE,
CAMERA_ALIGN_SLOPE, RETAIL_CLOSE_DEGRADES are retail behaviors wearing an
A/B off-switch. That set is now FROZEN by
LaunchOptionsDocumentationTests.OnlyTheFourRetailBehaviorFlagsDefaultOn;
docs/launch-options.md's Conventions and CLAUDE.md state the rule, and
CLAUDE.md now binds future probes to a documented row in the same commit.

The client reads 137 environment variables (161 at audit start); 40
temporary probes remain, every one attributed. Full hermetic suite 15,322
passed / 0 failed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/RuntimeOptions.cs

@@ -42,14 +42,16 @@ public sealed record RuntimeOptions(
     string? LivePass,
     bool DevTools,
     bool UncappedRendering,
+    /// <summary>#435 kept deliberately: NOT a spent probe. The canonical
+    /// nine-stop soak (`tools/run-connected-r6-soak.ps1`) hard-gates on the
+    /// `move-truth OUT` records this emits — it is the automated proof that
+    /// production input produced outbound movement traffic.</summary>
     bool DumpMoveTruth,
     bool DumpSky,
     bool NoAudio,
     int HidePartIndex,
     bool RetailCloseDegrades,
     bool DumpSceneryZ,
-    bool DumpLiveSpawns,
-    bool DumpClothing,
     int? LegacyStreamRadius,
     bool RetailUi,
     /// <summary>Campaign CC slice CC4: interim env/test-only seam that opens
@@ -157,8 +159,6 @@ public sealed record RuntimeOptions(
             // only for before/after diagnostic comparisons.
             RetailCloseDegrades: !string.Equals(env("ACDREAM_RETAIL_CLOSE_DEGRADES"), "0", StringComparison.Ordinal),
             DumpSceneryZ:        IsExactlyOne(env("ACDREAM_DUMP_SCENERY_Z")),
-            DumpLiveSpawns:      IsExactlyOne(env("ACDREAM_DUMP_LIVE_SPAWNS")),
-            DumpClothing:        IsExactlyOne(env("ACDREAM_DUMP_CLOTHING")),
             // Legacy override for ACDREAM_STREAM_RADIUS. Caller applies it on
             // top of the quality preset's radii. Null when unset or invalid.
             LegacyStreamRadius:  TryParseNonNegativeInt(env("ACDREAM_STREAM_RADIUS")),