feat(CT6): character window Y-resize clamped at retail's authored host minimum + shrink-and-scroll list contract

CT6 (Campaign CT slice 6): the resize clamp source is the SHARED
gmPanelUI host (0x100005FE in LayoutDesc 0x2100006E), not 0x2100002E's
own root and not the Character/Skills slot 0x1000018E either — live
probe confirmed the host authors MinWidth=MaxWidth=310 (fixed — no
horizontal Resizebar authored), MinHeight=372, MaxHeight=1000, and that
the bottom Resizebar (0x10000660) and top Dragbar (0x1000065C) are
direct children of the host, not the content parent. Decomp chain:
UIElement_Resizebar::StartMouseResizing @0x0046B7E0 calls
UIElement::StartResizing(this->GetParent(), ...), stashing drag state on
that parent; UIElement::MouseResizeElement @0x00461130 then reads
GetAttribute_Int(this, 0x3C..0x3F) off that same element every
mouse-move.

RetailUiRuntime.MountCharacter now imports the host element and passes
it as RetailWindowFrame.Options.DatConstraintSource, matching the
existing MountSideVitals pattern.

CharacterStatController.RebuildActiveList now wraps BOTH the Attributes
and Skills tabs' rows in the same UiScrollablePanel viewport (previously
only Skills got one; Attributes rows had no clipping/scrolling and the
shared scrollbar was force-hidden — owner report item 2). The shared
scrollbar is now always bound + visible; UiScrollbar's own
IsPresentationVisible/IsModelDisabled already draw the correct
full-track "disabled" thumb when content fits. This surfaced and fixed
a real #372/#412-class anchor-baseline bug: the viewport's
Left|Top|Bottom anchor was capturing its baseline margins lazily on its
own first ApplyAnchor call, which happens AFTER the ListBox has already
grown from its raw DAT height to its mounted height, permanently
capping the viewport short on every later resize. Fixed with an eager
CaptureCurrentAnchorBaseline() call, mirroring UiTemplateListBox
.Viewport's own lazy getter.

CharacterTitlesController.Bind gained the same defensive
Anchors = Left|Top|Bottom fallback for the Titles ListBox that
CharacterStatController already had (a no-op on the real DAT — both the
Titles page and its ListBox already carry a real authored LayoutPolicy
that stretches correctly).

Standardization audit: UiElement.MinWidth/MinHeight/MaxWidth/MaxHeight,
set once at RetailWindowFrame.Mount, are the ONLY clamp fields — read
identically by interactive drag, RetailWindowManager.ResizeTo, and
RetailWindowLayoutPersistence's restore clamp. No gaps found; no
register row (every number is a live-probed authored DAT value or a
structural correctness fix, nothing inferred).

Tests: CharacterStatControllerTests
.CharacterWindow_ResizesYWithinAuthoredHostClamp_AndReflowsListAndScrollbar,
CharacterTitlesControllerTests
.TitlesList_ReflowsWithWindowResize_AndScrollbarOverflowFlips,
RetailWindowFrameTests
.NineSlice_ChatShapedConstraints_ClampProgrammaticResizeAtAuthoredBounds
(shared-mechanism regression pin), CharacterPanelLiveDatTests
.PanelHost_AuthorsFixedWidthAndBottomOnlyResizeContract (InstalledDat
pin). Existing attribute-row tests updated from list.Children to
Descendants(list) for the new nested-viewport shape (the pattern skill
rows already needed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/UI/RetailUiRuntime.cs

@@ -4109,6 +4109,24 @@ public sealed class RetailUiRuntime : IDisposable
             TitleTemplateResolver,
             _bindings.Character.SendSetTitle);
 
+        // CT6 (2026-08-25 live probe): 0x2100002E's own content root
+        // (0x10000227) authors NO min/max (CT1 correction (a)) — retail's
+        // actual resize target is the SHARED gmPanelUI host (0x100005FE in
+        // LayoutDesc 0x2100006E). UIElement_Resizebar::StartMouseResizing
+        // @0x0046B7E0 calls UIElement::StartResizing(this->GetParent(), ...)
+        // and stashes the drag state (m_DragStart*/m_currentBorder) ON THAT
+        // PARENT; UIElement::MouseResizeElement @0x00461130 then reads
+        // GetAttribute_Int(this, 0x3C..0x3F) off the SAME element every
+        // mouse-move. The bottom Resizebar (0x10000660) is a DIRECT CHILD of
+        // the host, not of the content parent (0x10000180) — confirmed live:
+        // host 0x100005FE authors MinWidth=310 MinHeight=372 MaxWidth=310
+        // MaxHeight=1000 (Min==Max width: no horizontal Resizebar is
+        // authored, matching ResizeX=false below).
+        ElementInfo? hostConstraint;
+        lock (_bindings.Assets.DatLock)
+            hostConstraint = LayoutImporter.ImportInfos(
+                _bindings.Assets.Dats, 0x2100006Eu, 0x100005FEu);
+
         RetailWindowHandle handle = RetailWindowFrame.Mount(
             Host.Root,
             layout.Root,
@@ -4123,6 +4141,7 @@ public sealed class RetailUiRuntime : IDisposable
                 ResizeY = true,
                 ResizableEdges = ResizeEdges.Bottom,
                 ConstrainResizeToParent = true,
+                DatConstraintSource = hostConstraint,
                 Visible = false,
                 ContentAnchors = AnchorEdges.Left | AnchorEdges.Top | AnchorEdges.Bottom,
                 ContentClickThrough = false,