tools(gate): -ExeOverride and -DebuggerScript for the offline pixel gate; #422 characterised over 40 instrumented runs (Campaign VM VM7)

-ExeOverride runs another AcDream.App.exe through the SAME isolated
settings/scene/capture path so two binaries compare without mixing tool
versions (VM0's recorded fieldOfView trap). -DebuggerScript launches the
client under cdb so ntdll's debug heap validates every free and a heap
corruption breaks at the corrupting site with a stack.

#422 (1-in-8 STATUS_HEAP_CORRUPTION exit after a pack-on offline capture):
16 runs attached + 24 runs under the debug heap on 1f151242, all clean
(P ~ 0.5 % at the filed rate). Recorded as not reproducible on the current
binary, carried as a watch item for the owner's VM7 matrix with the loop as
the first step if it recurs; no longer a merge blocker. Evidence under
docs/research/evidence/vm7 alongside the final pack-off-vs-base+normals
robust diff (5-10 px, lifestone band only).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/run-offline-pixel-gate.ps1

@@ -125,6 +125,22 @@
 .PARAMETER SkipBuild
     Skip the Release build (use when the caller already built).
 
+.PARAMETER ExeOverride
+    Run this AcDream.App.exe instead of the repository's Release build, with
+    the SAME isolated settings, scene and capture path. Campaign VM VM7 used
+    it to compare the final binary against a reference binary built in a
+    throwaway worktree (VM0's base+normals) without mixing tool versions —
+    VM0 recorded that captures from two different tool versions are not
+    comparable (isolated-settings fieldOfView). Implies -SkipBuild.
+
+.PARAMETER DebuggerScript
+    Launch the client UNDER cdb (x64 Windows Debugger, -G -o -lines -cf
+    <script>) instead of directly. A process started under a debugger runs
+    with ntdll's debug heap (per-free validation), so a heap corruption
+    breaks at the corrupting site with a stack instead of fail-fasting at
+    exit. Campaign VM VM7 used it to characterise #422. The debugger's
+    console output (which includes the client's stdout) goes to client.log.
+
 .EXAMPLE
     # Capture a baseline at the parent commit, then gate the slice:
     git stash
@@ -164,7 +180,9 @@ param(
     # (#226). Default keeps the product default (on). Pass $false to capture the
     # pack-off frame without the building/EnvCell detail replay.
     [bool]$BuildingDetailTextures = $true,
-    [switch]$SkipBuild
+    [switch]$SkipBuild,
+    [string]$ExeOverride,
+    [string]$DebuggerScript
 )
 
 $ErrorActionPreference = 'Stop'
@@ -173,6 +191,15 @@ $exe = Join-Path $repo 'src\AcDream.App\bin\Release\net10.0\AcDream.App.exe'
 $cli = Join-Path $repo 'src\AcDream.Cli\bin\Release\net10.0\AcDream.Cli.dll'
 . (Join-Path $PSScriptRoot 'atmospheric-performance-matrix-common.ps1')
 
+if ($ExeOverride) {
+    if (-not (Test-Path $ExeOverride)) { throw "ExeOverride not found: $ExeOverride" }
+    $exe = (Resolve-Path $ExeOverride).Path
+    $SkipBuild = $true
+}
+if ($DebuggerScript -and -not (Test-Path $DebuggerScript)) {
+    throw "DebuggerScript not found: $DebuggerScript"
+}
+
 if ($AllowSafeRenderPackFallback -and $RenderPackPreset -eq 'retail') {
     throw '-AllowSafeRenderPackFallback is valid only for an explicitly selected enhanced preset.'
 }
@@ -309,8 +336,16 @@ if ($MsaaSamples -ge 0) { $env:ACDREAM_MSAA_SAMPLES = "$MsaaSamples" }
 else { Remove-Item Env:\ACDREAM_MSAA_SAMPLES -ErrorAction SilentlyContinue }
 
 Write-Step "launching offline client (pack $packId/$presetId, $Resolution, $(if ($Uncapped) { 'uncapped' } else { 'capped' }), orbit ${OrbitDistanceMeters}m/$OrbitYawDegrees deg yaw/$OrbitPitchDegrees deg pitch, warmup ${WarmupMs}ms, day group $DayGroup, day fraction $WorldDayFraction, sky phase $SkyPhaseSeconds, MSAA $MsaaSamples)"
-$proc = Start-Process -FilePath $exe -RedirectStandardOutput $log `
-    -RedirectStandardError "$log.err" -PassThru -WindowStyle Hidden
+$proc = if ($DebuggerScript) {
+    $cdb = 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe'
+    if (-not (Test-Path $cdb)) { throw "cdb.exe not found at $cdb (install the Windows Debugging Tools)." }
+    Start-Process -FilePath $cdb `
+        -ArgumentList @('-G', '-o', '-lines', '-cf', (Resolve-Path $DebuggerScript).Path, $exe) `
+        -RedirectStandardOutput $log -RedirectStandardError "$log.err" -PassThru -WindowStyle Hidden
+} else {
+    Start-Process -FilePath $exe -RedirectStandardOutput $log `
+        -RedirectStandardError "$log.err" -PassThru -WindowStyle Hidden
+}
 
 try {
     $shots = Join-Path $Out 'screenshots'