feat(ui): Campaign OP slice OP2 — tab control, template ListBox, UIOption widget mappings

Ships the two new widget primitives the retail Options panel needs plus the
four remaining UIOption_* factory mappings, so every tab page (OP3-OP6) has
somewhere to mount.

- ElementReader/ElementInfo gain three new dat-property readers, following
  the existing effective-state-resolution pattern (never a per-state
  first-wins scan, per the round-5 N1 lesson): the Type-8 tab table
  (property 0x2E -> TabTable), a ListBox's row-template list (property
  0x64 -> TemplateList), and scrollbar linkage (property 0x72 ->
  ScrollbarElementId). LayoutImporter gains one hook
  (IUiChildrenAttachedListener) so a widget can resolve cross-references
  its own dat properties name by id once its subtree actually exists.

- UiTabControl (Type 8): switches exactly one page-slot child visible,
  syncs each tab button's Open/Closed state via the existing
  RetailTabBinding helper, and honors the authored default tab on mount.

- UiTemplateListBox (Type 5 with an authored template list): wraps a
  UiScrollablePanel viewport (sealed, so composition not inheritance) and
  ports AddItemFromTemplateList(index) — the resolver seam a page
  controller wires with real DAT access via the SAME
  LayoutImporter.ImportInfos(dats, layoutId, elementId) overload
  RetailDialogFactory already uses for its catalog LayoutDesc.

- DatWidgetFactory maps the four remaining UIOption_* widgets, each
  verified against the regenerated options_2100002B.json fixture before
  writing any code: 0x10000037 (Slider) is structurally an ordinary
  horizontal UIElement_Scrollbar, so it reuses BuildScrollbar directly;
  0x10000038 (Menu) is structurally identical to the vendor category
  dropdown UiMenu already models, so it reuses `new UiMenu()` like the
  Type-6 case; 0x10000036 (CheckboxSlider) composes an existing
  UIOption_Checkbox child + UIOption_Slider child via the new
  UiOptionToggleSlider wrapper; 0x10000044 (CheckboxBitfield64) authors
  zero children in the dat (every row is added at runtime via retail's own
  AddChild(lowMask, highMask, label, tooltip) call shape), so it's a new
  UiCheckboxBitfield64 composing UiButton per row. No new drawing code
  anywhere in this set.

- Five new committed fixtures (options_2100002B/2100002A/21000028/
  2100005C/21000029) plus 25 new conformance tests pinning the tab table
  (4 entries, Gameplay default), all three template arrays, scrollbar
  linkage, every new widget-type mapping, and a UiTabControl behavioral
  test (switch -> exactly one page visible, click-through the tab
  button). The Character ListBox's authored 6-header/49-toggle shape
  (lane B section counts) is proven reachable end-to-end through
  AddItemFromTemplateList against the committed fixture.

- Regenerating fixtures also touched 27 PRE-EXISTING, unrelated fixtures
  (an Outline/OutlineColor field pair added by an earlier commit,
  bcc34ee3, that predates when those fixtures were last regenerated).
  Per the slice contract, that drift was NOT committed — reverted back to
  HEAD, only the five new Options-panel fixtures are new files here.

- Filed TS-72: UiCheckboxBitfield64's click-toggle bit math (AND/OR
  set/clear semantics) is a documented approximation — the decompiled
  excerpt this campaign pulled covers UIOption_CheckboxBitfield64::Apply's
  WRITE side, not its own click-handler's bit math. Flagged for OP5 (the
  Chat tab controller, the first consumer that reaches the wire) to
  verify against the real decomp before any live transaction depends on
  it; nothing user-reachable can observe this yet.

Full Release suite: 12,770 passed / 4 skipped / 0 failed (was 12,745/4/0
post-OP1 — 25 net new tests, zero regressions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/UI/UiTemplateListBox.cs

@@ -0,0 +1,119 @@
+using System;
+using System.Collections.Generic;
+using System.Numerics;
+using AcDream.App.UI.Layout;
+
+namespace AcDream.App.UI;
+
+/// <summary>
+/// Retail <c>UIElement_ListBox</c> (Type 5) with an authored row-template list (dat
+/// property <c>0x64</c>). Port of <c>AddItemFromTemplateList(index)</c>: instantiates
+/// row <paramref name="index"/>'s template — a <see cref="UiTemplateListEntry"/>
+/// naming a cross-layout <c>{LayoutDesc DID, element id}</c> pair, per
+/// <c>docs/research/2026-08-10-options-panel-structure.md</c> §1.5 — through the SAME
+/// import machinery every other retained window uses, and appends it as one
+/// scrollable row.
+///
+/// <para>
+/// Wraps a <see cref="UiScrollablePanel"/> as its single child rather than
+/// duplicating its scroll logic — <see cref="UiScrollablePanel"/> is sealed, and this
+/// is the SAME "controller-built row list" viewport pattern
+/// <c>CharacterStatController.RebuildActiveList</c> already uses for the skill list
+/// (a <see cref="UiScrollablePanel"/> child sized to its host, rows added through it).
+/// The wrapped panel is anchored to fill this box, so scrolling, per-row visibility
+/// clipping, and the pixel scroll model (<see cref="Scroll"/>) all come from the
+/// SAME code CH6/the character sheet already exercise — no new scroll model. Rows
+/// stack in call order: each new row's <see cref="UiElement.Top"/> is set to the
+/// viewport's current <see cref="UiScrollablePanel.ContentHeight"/> before it is
+/// added, exactly retail's own ListBox layout (each row is authored at its own
+/// template-local Y=0; the box stacks instances).
+/// </para>
+///
+/// <para>
+/// <see cref="TemplateResolver"/> is the seam a page controller wires with real DAT
+/// access — e.g. <c>(layoutId, elementId) =&gt; LayoutImporter.Build(
+/// LayoutImporter.ImportInfos(dats, layoutId, elementId), resolve, datFont,
+/// fontResolve, stringResolve)?.Root</c> (the SAME "one selected root from a
+/// catalog-style LayoutDesc" overload <c>RetailDialogFactory</c> already uses for the
+/// shared dialog catalog — the Options panel's row templates are top-level siblings
+/// of the tab control in <c>0x2100002B</c>, structurally identical to that catalog
+/// shape). Left null by <c>DatWidgetFactory</c> itself: OP2 ships the mechanism, a
+/// page controller (Campaign OP slice OP4+) supplies the resolver once it has a live
+/// <c>IDatReaderWriter</c>.
+/// </para>
+/// </summary>
+public sealed class UiTemplateListBox : UiPanel
+{
+    private readonly UiScrollablePanel _viewport = new()
+    {
+        Anchors = AnchorEdges.Left | AnchorEdges.Top | AnchorEdges.Right | AnchorEdges.Bottom,
+    };
+
+    /// <summary>The authored row-template list (dat property 0x64), in authored array order.</summary>
+    public IReadOnlyList<UiTemplateListEntry> Templates { get; }
+
+    /// <summary>
+    /// Element id of this ListBox's linked scrollbar (dat property 0x72; e.g. the
+    /// Character page's ListBox 0x100001FA names scrollbar 0x100001FB). 0 when the
+    /// dat authors no scrollbar reference. A page controller resolves this id against
+    /// the imported tree and sets the found <see cref="UiScrollbar"/>'s
+    /// <see cref="UiScrollbar.Model"/> to <see cref="Scroll"/> — the same linkage
+    /// <c>ChatWindowController</c> wires for the chat transcript.
+    /// </summary>
+    public uint ScrollbarElementId { get; }
+
+    /// <summary>The wrapped viewport's pixel scroll model — link a page controller's
+    /// resolved scrollbar (<see cref="ScrollbarElementId"/>) to this.</summary>
+    public UiScrollable Scroll => _viewport.Scroll;
+
+    /// <summary>Total stacked row height in px — the same value <see cref="Scroll"/>'s
+    /// content extent uses.</summary>
+    public int ContentHeight => _viewport.ContentHeight;
+
+    /// <summary>Row height for the scroll model's line-scroll quantum. Set once template
+    /// heights are known; defaults to the viewport's own default (16px).</summary>
+    public int LineHeight
+    {
+        get => _viewport.LineHeight;
+        set => _viewport.LineHeight = value;
+    }
+
+    /// <summary>
+    /// Instantiates a row template's subtree (its LayoutDesc DID + element id) into a
+    /// built <see cref="UiElement"/>. Null (the default) means
+    /// <see cref="AddItemFromTemplateList"/> cannot build rows yet.
+    /// </summary>
+    public Func<uint, uint, UiElement?>? TemplateResolver { get; set; }
+
+    public UiTemplateListBox(IReadOnlyList<UiTemplateListEntry> templates, uint scrollbarElementId)
+    {
+        Templates = templates;
+        ScrollbarElementId = scrollbarElementId;
+        BackgroundColor = Vector4.Zero;
+        BorderColor = Vector4.Zero;
+        base.AddChild(_viewport);
+    }
+
+    /// <summary>
+    /// Retail <c>UIElement_ListBox::AddItemFromTemplateList(m_pOptionBox, index,
+    /// nullptr)</c>: resolves <c>Templates[index]</c> through <see cref="TemplateResolver"/>
+    /// and appends the built subtree as the next row, stacked below the previous one.
+    /// Returns the built row widget, or null when <paramref name="index"/> is out of
+    /// range, no resolver is wired, or the resolver produced nothing.
+    /// </summary>
+    public UiElement? AddItemFromTemplateList(int index)
+    {
+        if (index < 0 || index >= Templates.Count) return null;
+        Func<uint, uint, UiElement?>? resolver = TemplateResolver;
+        if (resolver is null) return null;
+
+        UiTemplateListEntry entry = Templates[index];
+        UiElement? row = resolver(entry.TemplateLayoutId, entry.TemplateElementId);
+        if (row is null) return null;
+
+        row.Left = 0f;
+        row.Top = _viewport.ContentHeight;
+        _viewport.AddChild(row);
+        return row;
+    }
+}