feat(render): Campaign V slice V5 - Vulkan bring-up, dark

Instance, physical-device selection, logical device, queues, swapchain, and the
three-layer capability gate, behind ACDREAM_RENDER_BACKEND=vulkan. Nothing of
the game renders through it. OpenGL stays the default and the only live backend
until V10, and with the variable unset or set to gl the GL path executes not one
new statement.

The shape of the slice. Plan §4.11 asks the Vulkan gate to mirror the GL one
exactly - passive record, active probes, an Evaluate producing operator-facing
sentences, NotSupportedException into Program.cs's exit-code-4 contract, and an
atomic JSON report. The harder question was where to put the seam, because a
capability gate is precisely the code you cannot exercise on the machine that
already passes it: this box has one discrete GPU, so device ranking, the split-
queue path, an sRGB-only surface, a minimised window and a device missing
descriptorBindingVariableDescriptorCount are all unreachable by running the
client. So every decision the gate makes is a pure function over plain records,
and the Silk interop layer only has to be right about which Vulkan field feeds
which property. VulkanPhysicalDeviceSelection ranks candidates,
VulkanExtensionSelection does the required-versus-optional set arithmetic,
VulkanSwapchainConfigurationFactory chooses format, present mode, image count,
extent, usage, transform and composite alpha, VulkanSwapchainRecreationPolicy
classifies every acquire and present result, and
VulkanCapabilityRequirements.Evaluate turns a captured record into failure
sentences. All of it is unit-tested with no driver, no device and no window.

This commit is the integration of that work onto the post-revert tree. The V5
branch was written on b064668b, before V4c/V4d were reverted, so GameWindow.cs
had to be merged rather than taken: the file here is eb2ba4e5's GameWindow plus
V5's fifteen-line backend branch, and it keeps _terrainModernShader, which the
revert restored and which the V5 branch never had. Every other file is byte-
identical to the branch - git diff e1ef4313 over Rendering/Gpu/Vk,
tests/.../Gpu/Vk and RenderBackendKind.cs is empty, no BOM was introduced, and
CRLF is uniform across all seventeen files.

Gate results, recorded verbatim.

Release build: succeeded, 0 warnings, 0 errors.

App tests, Release: Failed 0, Passed 3981, Skipped 3, Total 3984 - the 3,866
baseline plus V5's 115 new tests, exactly.

Offline pixel gate against eb2ba4e5: PASS world-offline.png, differing fraction
1.06534090909091E-05, which is 6 differing pixels out of the 563,200 compared
after the top 280 sky rows are masked. §5.1's re-measured same-commit control
band is 15-23 pixels at fraction <= 4.1e-05, so this sits below the noise floor
rather than merely inside it - the expected result for a slice that adds no
statement to the GL path.

Vulkan check (a), ACDREAM_RENDER_BACKEND=vulkan on the RX 9070 XT with an
automation artifact directory:

  vulkan: capability gate passed (Windows, AMD Radeon RX 9070 XT, Vulkan
  1.4.349, vendor 0x1002, device 0x7550, driver 2.0.395 (raw 0x0080018B));
  swapchain B8G8R8A8Unorm/PresentModeImmediateKhr 1280x720 x3
  vulkan: device selection - automatic: 'AMD Radeon RX 9070 XT' (DiscreteGpu,
  15.92 GiB device-local) ranked first of 2 enumerated device(s).
  [world-gate] screenshot-complete name=vulkan-bringup path=...
  artifacts\vk-bringup\vulkan-bringup.png size=1280x720
  vulkan: presented 64609 clear-colour frame(s); shutting down.

Exit code 0 on CloseMainWindow. The PNG is 5,238 bytes, 1280x720, and uniformly
RGBA(11,19,39,255) - exactly ClearColor [0.043, 0.075, 0.153, 1] scaled to
UNORM. Orientation is right-side-up by construction rather than by inspection,
which a uniform clear could not show: VulkanBackbufferSwizzle.ToGlOriginRgba
writes source row y into destination row height-1-y precisely because
FrameScreenshotController flips again on the way to the PNG, so the two
cancel. That double-flip is unit-tested.

Vulkan check (b), ACDREAM_VULKAN_FORCE_UNSUPPORTED=timelineSemaphore:

  [ERR] acdream's Vulkan renderer is unsupported by the selected device.
  Platform: win-x64, Windows, AMD Radeon RX 9070 XT (DiscreteGpu), Vulkan
  1.4.349, vendor 0x1002, device 0x7550, driver 2.0.395 (raw 0x0080018B)
   - timelineSemaphore is required; the frame serial is the semaphore value.
  Full capability report: ...\diagnostics\graphical-capabilities-vulkan.json

Exit code 4. The report records ForcedUnsupportedFeature timelineSemaphore,
TimelineSemaphore false against an otherwise complete feature set, and the
matching SupportFailures sentence, so the injected rejection is distinguishable
from a genuinely absent feature. Both enumerated devices, all five surface
formats, all four present modes and a clean FunctionProbe with no failures are
recorded beside it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/RuntimeOptions.cs

@@ -56,7 +56,10 @@ public sealed record RuntimeOptions(
     float FogStartMultiplier,
     float FogEndMultiplier,
     ResidencyBudgetOptions ResidencyBudgets,
-    StreamingWorkBudgetOptions StreamingWorkBudgets)
+    StreamingWorkBudgetOptions StreamingWorkBudgets,
+    RenderBackendKind RenderBackend,
+    string? VulkanDeviceOverride,
+    string? VulkanForcedUnsupportedFeature)
 {
     /// <summary>
     /// Build options from the process environment. Used by
@@ -118,9 +121,32 @@ public sealed record RuntimeOptions(
             FogStartMultiplier:  TryParseFloat(env("ACDREAM_FOG_START_MULT")) ?? 0.7f,
             FogEndMultiplier:    TryParseFloat(env("ACDREAM_FOG_END_MULT")) ?? 0.95f,
             ResidencyBudgets:    ResidencyBudgetOptions.Parse(env),
-            StreamingWorkBudgets: StreamingWorkBudgetOptions.Parse(env));
+            StreamingWorkBudgets: StreamingWorkBudgetOptions.Parse(env),
+            // Campaign V slice V5. Unset, empty, or any unrecognised value means
+            // OpenGL: a typo must never silently start the dark Vulkan host.
+            RenderBackend:       ParseRenderBackend(env("ACDREAM_RENDER_BACKEND")),
+            // Physical-device override, matched as a decimal index first and then
+            // as a case-insensitive device-name substring. Recorded verbatim in
+            // graphical-capabilities-vulkan.json whether or not it matched.
+            VulkanDeviceOverride:
+                NullIfEmpty(env("ACDREAM_VULKAN_DEVICE")),
+            // Slice V5 gate knob: names one required capability to report as
+            // absent so the NotSupportedException -> exit-code-4 -> report path
+            // can be exercised on hardware that actually supports everything.
+            VulkanForcedUnsupportedFeature:
+                NullIfEmpty(env("ACDREAM_VULKAN_FORCE_UNSUPPORTED")));
     }
 
+    /// <summary>
+    /// Startup backend request. Only the exact lower-case token <c>vulkan</c>
+    /// selects Vulkan; everything else — unset, <c>gl</c>, or a typo — is
+    /// OpenGL, which is the shipping backend until Campaign V slice V10.
+    /// </summary>
+    private static RenderBackendKind ParseRenderBackend(string? value)
+        => string.Equals(value, "vulkan", StringComparison.OrdinalIgnoreCase)
+            ? RenderBackendKind.Vulkan
+            : RenderBackendKind.Gl;
+
     /// <summary>True iff live-mode credentials are present and valid for connecting.</summary>
     public bool HasLiveCredentials =>
         LiveMode && !string.IsNullOrEmpty(LiveUser) && !string.IsNullOrEmpty(LivePass);