fix(chat): CH3 review fixes — phantom UN-9, allegiance-broadcast echo, /a legacy fallback

Applies the Opus review of Campaign CH slice CH3 (614a1e05):

- B1: UN-9 was a phantom divergence — ACE's CharacterOptions1.cs:47
  OR-sum is 0x50C4A54A (its own comment confirms 1355064650), identical
  to acdream's literal. The wrong 0x50C48D4A existed only in the research
  doc. Row deleted, register §5 reverted to 4 rows, research doc corrected
  with dated notes.
- S1/S4: AllegianceBroadcast (0x02000000) is a server-echoing channel —
  ACE's GameActionChatChannel handler includes the sender in its real-name
  Allegiance.Members broadcast (retail's DoAllegianceBroadcast has no
  AddTextToScroll), so the client must skip its local optimistic echo, not
  keep it. ChatChannelInfo.Legacy.IsSelfEchoChannel() now returns true for
  it; RouteLegacyChannel's comment corrected; Turbine.IsSelfEchoChannel()'s
  backwards comment rewritten truthfully.
- S3: retail's /a stays on the legacy AllegianceBroadcast bitflag until
  StartupTurbineChatSystem successfully starts Turbine chat — "never
  started" (TurbineChatState.Enabled == false) now falls back to legacy in
  both LiveSessionCommandRouter.RouteChat and
  DirectGameRuntimeCommandAdapter.TrySendChannel, while "enabled but no
  allegiance room" still correctly refuses locally.
- S5: added a LiveSessionEventRouter test proving the Options.Replace ->
  OnCharacterOptionsChanged seeding order, and RuntimeSettingsTargets /
  GameWindowLiveSessionOwnershipTests tests proving the concrete
  ICommandBus.Publish wiring and the single LiveSessionCommandSurface
  construction site.
- S6: AP-181 rewritten to name both of retail's omitted pre-send checks
  (IsMessageSafe silent-drop, then IsMessageSpam) and stop misattributing
  either to RouteLegacyChannel, which has no such gates.
- N1-N7: CharacterOptionId moved below SocialActions so its doc comment
  re-attaches; TurbineChatMembershipGate reuses TurbineChatDisplayNames
  instead of a duplicate table; the gate-to-refusal-text mapping is now
  shared via TurbineChatMembershipGate.ResolveRefusalText instead of
  duplicated in both hosts; ChatSettings.Default now matches ACE's real
  CharacterOptions2.Default (Roleplay/Society start off); a doc-comment
  clarifies only the five Hear toggles are server-backed; the register's
  §3 header recounted 129 -> 128.

Suite: 11,964 passed / 4 skipped / 0 failed (baseline 11,957/4/0 + 7 new
tests). Campaign ledger CH3 review column updated to APPROVE-WITH-FIXES.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/research/2026-08-09-chat-side-channels-vs-ace.md

@@ -300,7 +300,13 @@ and from allegiance changes.
 | `0x00080000` | HearSocietyChat | **NO** |
 
 `Default = 0x00948700`. `CharacterOptions1.Default` includes
-`HearAllegianceChat (0x40000000)`; `CharacterOptions1.Default = 0x50C48D4A`.
+`HearAllegianceChat (0x40000000)`; `CharacterOptions1.Default = 0x50C4A54A`
+(corrected 2026-08-09 at the CH3 Opus review — the original filing here
+had `0x50C48D4A`, a copy error with no basis in ACE's own source; ACE's
+`CharacterOptions1.cs:47` OR-sum is `0x50C4A54A`, confirmed by its own
+inline comment `// 1355064650`, and is identical to acdream's
+`PlayerDescriptionParser.cs:217`. This wrong literal is what filed the
+now-retracted UN-9 register row).
 `PlayerFactory.CharacterCreateSetDefaultCharacterOptions` sets exactly these
 two defaults on every new character.
 
@@ -620,7 +626,9 @@ unknown channel ids are dropped with no client-visible response.
 as `flags`, then reads `characterOptions1` past the end of the payload.
 Worse, `CharacterOptionDataFlag.CharacterOptions2 = 0x40` collides with
 `CharacterOptions1.AllowGive = 0x40`, which **is** set in
-`CharacterOptions1.Default (0x50C48D4A)` — so ACE would also try to read an
+`CharacterOptions1.Default (0x50C4A54A)` (corrected 2026-08-09 at the CH3
+Opus review; see the §3.5 correction note above — same copy error, same
+fix) — so ACE would also try to read an
 options2 value. Reachable only via `IGameRuntimeCommands.SetOptions1`, which has
 no production call site (grep: only tests). **Latent, but this is the exact
 message a Settings-sync feature would reach for.**