fix: harden persistence, rendering, and audit verification

[MichaelFisher1997]

Summary

Harden the concrete correctness and verification issues found in the repository-wide audit, and remove the three confirmed orphan source files.

• Preserve world identity and saved origin chunks; add recoverable region replacement, bounded retryable save snapshots, safe shutdown sweeps, and atomic settings/metadata replacement.
• Correct worker/resource lifetimes, mesh snapshot synchronization, lighting cancellation and boundary propagation, and audio teardown.
• Make indirect draw payloads and descriptor bindings immutable within a frame; fix LPV resizing, MSAA/G-pass/TAA state, Vulkan constructor rollback, and failed-frame quarantine.
• Centralize settings application and register direct module test roots with named discovery and empty-filter rejection.
• Harden CI review isolation, visual/benchmark acceptance, coverage collection, shader artifact validation, and developer documentation.
• Remove the unused Vec4 source and two Vulkan forwarding files, including their automation and test-discovery references.

This is a broad audit remediation PR. Many changed files are module test-root registrations, regression tests, or previously ignored runtime SPIR-V artifacts. All runtime shader binaries are included so clean checkouts do not depend on local generated files.

Verification

• Zig 0.16.0 through devenv; formatting and whitespace checks pass.
• Debug unit suite: 1,917/1,917 tests passed.
• ReleaseSafe unit suite: 1,917/1,917 tests passed.
• Discovery: 1,890 named tests across 31 roots; empty named filters fail.
• ReleaseFast build and shader freshness/size/shadow ABI checks pass.
• Isolated Weston/Lavapipe integration: 4/4 tests pass with zero Vulkan validation errors, including persistent-origin reload, active LPV resizing, MSAA recreation, uploads, and teardown.
• Legal guarded Vulkan transfer/readback smoke passes; no shader-OOB robustness claim.
• Flat-world screenshot captured and inspected without a visible window.
• Actionlint, ShellCheck, and 22 offline CI verification regressions pass.
• LLVM-backed kcov collection completes all 31 executables: 21,485/27,431 instrumented project lines hit (78.32%) across 282 files.
• Repository pre-push checks rerun before pushing; focused math/graphics checks after dead-code removal passed 555/555 tests.

Coverage includes test code and only lines emitted into test executables. It is not whole-repository or branch coverage. Ordinary builds retain their default compiler backend.

Review Notes

Independent follow-up review was used to check the integrated persistence/concurrency, graphics, and CI patches. Findings were corrected and regression-tested.

See docs/audit-hardening.md for the implementation record and limitations, docs/ci-review-security.md for the trusted-base review boundary, and modules/worldgen-overworld/TEST_CONTRACTS.md for evidence supporting restored worldgen fixtures. Worldgen tuning was not changed just to make old fixtures pass.

Live UI/generator consolidation, larger package extraction, asset licensing, physical-GPU performance, and release approval remain separate work. Region compaction, same-world multi-process access, and directory-entry power-loss durability are not claimed.

Pre-existing local changes to the root .gitignore and devenv.lock are intentionally excluded. This PR does not authorize automatic merging.

[github-actions]

kcov coverage

Collection: success. Report artifact uploaded as kcov-report.

Codecov: skipped (uploads are push-only). No coverage threshold or branch coverage is claimed. Run details.

[MichaelFisher1997]

Latest head: 0532af45ad905192ce59a12d89a6eb7cb5d4fe30.

The runner remains the existing 2-vCPU configuration. No preset, resolution, or SLO threshold was reduced, and no failing check was bypassed.

All latest-head hosted checks are green except the benchmark job and its associated performance/benchmark status: Build, Debug/ReleaseSafe unit tests, graphics integration (including presented smoke), coverage, lint, workflow validation, asset budget, DCO, and security scans passed. Both reported security-review threads are resolved.

The remaining benchmark failure is low/stationary p1 FPS: 6.87 measured, 12.00 required. Its other reported limits pass: maximum frame 146.32/260 ms, draw calls 481/700, vertices 716,544/3,500,000, GPU memory 170.48/2,200 MiB. The initial CI attempt reported 4.69 p1 FPS and 214.07 ms maximum frame; these are observed separate CI runs, not a statistically controlled hardware comparison.

The benchmark still correctly exits with BenchmarkSloBreach, now retaining its measured JSON in the benchmark-results artifact. The suite stops at this first failed scenario; the other eleven scenarios are not claimed verified. Further renderer performance work is needed to meet the current gate on this runner.

The PR remains open and unmerged. No runner upgrade or automatic merge was enabled.

Latest benchmark run