fix #435 (part 2, closes it): attribute the unowned probes — delete 7, reclassify 8, restore 1

Part 1 deleted probes whose owning issues were closed. These 14 named no
issue at all, so each was traced to its introducing commit
(git log -S) instead of guessed at. Attribution split them three ways:

DELETED (7, investigations closed): ACDREAM_A8_DUMP_PV and
ACDREAM_DUMP_LIVE_SPAWNS (Phase A8), ACDREAM_DUMP_CLOTHING (#37),
ACDREAM_DUMP_EDGE_SLIDE (#32), ACDREAM_DUMP_STEPUP (L.2.3d-f),
ACDREAM_DUMP_VENDOR (the vendor campaign, 25 call sites across 8 files),
ACDREAM_DUMP_VITALS (#5, four independent read sites). VendorDiagnostics.cs
went entirely.

RECLASSIFIED (8, tools misfiled as probes): the DUMP_CELLS/DUMP_GFXOBJS
fixture-extraction family (replay-harness tooling with a roundtrip test),
PROBE_CELL (standing cell-transit tracer, pair of the permanent
PROBE_RESOLVE), DUMP_SKY and HIDE_PART (generic isolation tools), and
DUMP_STEEP_ROOF — which looked like an L.4 relic but observes LIVE
divergence-register row AD-56; deleting it would have removed the only
runtime lens on an active divergence. All moved to Permanent diagnostics
with their attribution recorded.

RESTORED (1): ACDREAM_DUMP_MOVE_TRUTH was deleted and un-deleted the same
day. It is not a probe — the canonical nine-stop soak
(run-connected-r6-soak.ps1) hard-fails every destination without its
'move-truth OUT' records, with a message that would misdirect the next
operator. Under the no-workarounds rule the gate's mechanism is restored,
not left broken with an IOU (#437, closed). Process lesson recorded on
both issues: a closed owning issue is NOT sufficient to delete a probe —
grep tools/ and the contract tests for consumers first.

Also lands the owner-requested default-off invariant: every diagnostic in
the codebase is inert until its env var is explicitly set. Exactly four
flags default ON and none is a diagnostic — RETAIL_CHASE, CAMERA_COLLIDE,
CAMERA_ALIGN_SLOPE, RETAIL_CLOSE_DEGRADES are retail behaviors wearing an
A/B off-switch. That set is now FROZEN by
LaunchOptionsDocumentationTests.OnlyTheFourRetailBehaviorFlagsDefaultOn;
docs/launch-options.md's Conventions and CLAUDE.md state the rule, and
CLAUDE.md now binds future probes to a documented row in the same commit.

The client reads 137 environment variables (161 at audit start); 40
temporary probes remain, every one attributed. Full hermetic suite 15,322
passed / 0 failed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Core/Items/VendorDiagnostics.cs

@@ -1,27 +0,0 @@
-using System;
-
-namespace AcDream.Core.Items;
-
-/// <summary>
-/// TEMPORARY diagnostic-probe owner for two live-only regressions that have
-/// each survived two green-tested fixes: Chain A (a far-click walk-to-use
-/// approaches a vendor, the vendor plays its cosmetic greeting, but the shop
-/// window never opens) and Chain B (selecting a splittable vendor stack
-/// shows the bare item name with no quantity slider). Every probe line is
-/// prefixed <c>[vendor-diag]</c> and gated on <see cref="DumpVendorEnabled"/>
-/// so the family is a true no-op when the flag is unset.
-/// </summary>
-/// <remarks>
-/// Read once from <c>ACDREAM_DUMP_VENDOR=1</c> at process start, per Code
-/// Structure Rule 5 (one static diagnostic-owner class per subsystem, no
-/// per-call-site <see cref="Environment.GetEnvironmentVariable"/> reads).
-/// Lives in <c>AcDream.Core</c> — the one project every call site (App,
-/// Core.Net, Runtime) already references — so a single flag instance is
-/// shared across the whole probe family regardless of which layer observes
-/// it first.
-/// </remarks>
-public static class VendorDiagnostics
-{
-    public static bool DumpVendorEnabled { get; } =
-        Environment.GetEnvironmentVariable("ACDREAM_DUMP_VENDOR") == "1";
-}