tools(gate): -ExeOverride and -DebuggerScript for the offline pixel gate; #422 characterised over 40 instrumented runs (Campaign VM VM7)

-ExeOverride runs another AcDream.App.exe through the SAME isolated
settings/scene/capture path so two binaries compare without mixing tool
versions (VM0's recorded fieldOfView trap). -DebuggerScript launches the
client under cdb so ntdll's debug heap validates every free and a heap
corruption breaks at the corrupting site with a stack.

#422 (1-in-8 STATUS_HEAP_CORRUPTION exit after a pack-on offline capture):
16 runs attached + 24 runs under the debug heap on 1f151242, all clean
(P ~ 0.5 % at the filed rate). Recorded as not reproducible on the current
binary, carried as a watch item for the owner's VM7 matrix with the loop as
the first step if it recurs; no longer a merge blocker. Evidence under
docs/research/evidence/vm7 alongside the final pack-off-vs-base+normals
robust diff (5-10 px, lifestone band only).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/cdb/i422-heap-launch.cdb

@@ -0,0 +1,11 @@
+.sympath C:\Windows\System32
+.symopt+ 0x40
+sxe -c "!analyze -v; ~*kb 40; lm; q" bpe
+sxe -c "!analyze -v; ~*kb 40; lm; q" av
+sxe -c "!analyze -v; ~*kb 40; lm; q" c0000374
+sxe -c "!analyze -v; ~*kb 40; lm; q" c0000409
+sxd ld
+sxd ud
+sxd clr
+sxd clrn
+g