tools(gate): -ExeOverride and -DebuggerScript for the offline pixel gate; #422 characterised over 40 instrumented runs (Campaign VM VM7)

-ExeOverride runs another AcDream.App.exe through the SAME isolated
settings/scene/capture path so two binaries compare without mixing tool
versions (VM0's recorded fieldOfView trap). -DebuggerScript launches the
client under cdb so ntdll's debug heap validates every free and a heap
corruption breaks at the corrupting site with a stack.

#422 (1-in-8 STATUS_HEAP_CORRUPTION exit after a pack-on offline capture):
16 runs attached + 24 runs under the debug heap on 1f151242, all clean
(P ~ 0.5 % at the filed rate). Recorded as not reproducible on the current
binary, carried as a watch item for the owner's VM7 matrix with the loop as
the first step if it recurs; no longer a merge blocker. Evidence under
docs/research/evidence/vm7 alongside the final pack-off-vs-base+normals
robust diff (5-10 px, lifestone band only).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/i422/loop-debugheap.ps1

@@ -0,0 +1,39 @@
+<#
+.SYNOPSIS
+    #422 characterisation loop: N offline High captures, each launched under
+    cdb with the debug heap (tools/run-offline-pixel-gate.ps1 -DebuggerScript),
+    summarised to artifacts/i422dh/summary.txt.
+.EXAMPLE
+    pwsh tools/i422/loop-debugheap.ps1 -Runs 24
+#>
+param([int]$Runs = 24)
+$ErrorActionPreference = 'Continue'
+$repo = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+$root = Join-Path $repo 'artifacts\i422dh'
+New-Item -ItemType Directory -Force $root | Out-Null
+$summary = Join-Path $root 'summary.txt'
+"run,gateExit,shutdownLine,heapLine" | Set-Content $summary
+for ($i = 1; $i -le $Runs; $i++) {
+    $out = Join-Path $root ("run-{0:D2}" -f $i)
+    $gateOut = Join-Path $root ("gate-{0:D2}.out" -f $i)
+    $gateErr = Join-Path $root ("gate-{0:D2}.err" -f $i)
+    $gate = Start-Process -FilePath 'pwsh' -ArgumentList @(
+        '-NoProfile', '-File', (Join-Path $repo 'tools\run-offline-pixel-gate.ps1'),
+        '-Out', $out, '-SkipBuild', '-RenderPackPreset', 'high', '-Uncapped',
+        '-DebuggerScript', (Join-Path $repo 'toolsbi422-heap-launch.cdb')) `
+        -PassThru -WindowStyle Hidden -RedirectStandardOutput $gateOut -RedirectStandardError $gateErr
+    $gate.WaitForExit()
+    $clientLog = Join-Path $out 'client.log'
+    $shutdown = ''
+    $m = Select-String -Path $gateErr -Pattern 'exited with code|timed out|No screenshot' -ErrorAction SilentlyContinue | Select-Object -First 1
+    if ($m) { $shutdown = $m.Line.Trim() -replace ',', ';' }
+    $heap = ''
+    if (Test-Path $clientLog) {
+        $h = Select-String -Path $clientLog -Pattern 'HEAP\[|Critical error|heap corruption|FAULTING_IP|Access violation|STATUS_HEAP|second chance|!analyze' |
+            Where-Object { $_.Line -notmatch '^\d+:\d+> sxe' } | Select-Object -First 1
+        if ($h) { $heap = $h.Line.Trim() -replace ',', ';' }
+    }
+    "$i,$($gate.ExitCode),$shutdown,$heap" | Add-Content $summary
+    Write-Host ("run {0}: gate {1} {2} {3}" -f $i, $gate.ExitCode, $shutdown, $heap)
+}
+Get-Content $summary