fix(content): S1 review round - retail default sides shape, mask hoist, upload order

Campaign OVERHAUL S1 review fixes (two Opus lens reviews, findings verified
by the lead against the decomp):

- a raw sides_type outside 0/1/2 constructs retail's default single-side
  shape (ConstructMesh @0x0059DFA0 loop bounds default to 1) instead of
  dropping the polygon; still counted as a data anomaly (corpus has none);
- the positive-surface stippling mask OR runs once per polygon before the
  degenerate-fan guard, as retail's count loop does (pseudo-C 426859-426866);
- untextured slots keep their mask accounting but bake no texture and no
  vertices (contract §9 item 3); the dev pak shrinks by 114 KB;
- failed surface-override / Surface / texture-dependency lookups are
  attempted and logged once per slot, not once per candidate;
- cell-shell batches upload in ascending source surface index, retail's
  built-EnvCell subset draw order (ConstructMesh attribute-range scan,
  DrawMesh @0x0059D4A0); ordinary GfxObj meshes keep storage order;
- CellMesh.HasDrawableGeometry documented as the admission rule without
  texture-dependency resolution (a conservative superset of emission);
- the stippling/surface equivalence sweep's cell half is pinned at zero
  again; InAscendingSurfaceOrder is marked bake/upload/test-only;
- plan §5: reviewer findings are verified by the lead, one skeptic at most
  for a blocking finding, never more than five agents per step.

Three new Content tests pin the mask hoist, the vertex-free untextured
slot, and the single-side fallback. Content 213/213, Core Meshing and
Conformance green, App hermetic 6,757/6,757, Release build 0/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/AcDream.Content/ObjectMeshData.cs

@@ -236,6 +236,11 @@ public static class CellSurfaceSubsets {
     /// was never emitted into <see cref="ObjectMeshData.TextureBatches"/>
     /// in the first place, so it is absent here too — this enumerates
     /// DRAWABLE subsets, not every constructed slot.
+    /// This LINQ form allocates and is for bake, upload, and test time only
+    /// (App uploads consume it once per mesh in
+    /// <c>ObjectMeshManager.OrderedUploadBatches</c>). A per-frame consumer
+    /// must read a precomputed order (the uploaded batch list already is one),
+    /// never call this per frame.
     /// </summary>
     public static IEnumerable<TextureBatchData> InAscendingSurfaceOrder(ObjectMeshData mesh) =>
         mesh.TextureBatches.Values