Race release repair: 1.0.9-stability-playtest.2

Root cause
The party start repair rejected Go when its epoch/frame was at or before
the local cursor and its controls generation was unchanged. ScenePrepare
already increments cursor to the new epoch at frame zero before Go arrives.
Spectator ready() similarly advances cursor during checkpoint admission.
Thus a legitimate first release could be mistaken for an already applied
release. The second Running-phase cursor guard had the same spectator risk.

The newer host/client logs share match 5271837563691785035 and resource hash
462c89068d5532fb004db97a2261ff9e18d3fa1a7538e68fefba09276fcacbca.
The host completed scene preparation and logged a release for epoch 92,
frame zero. The client completed preparation for epoch 92 but never advanced.
The host later stopped with the existing 90-second no-progress watchdog.
Earlier client/spectator logs show the same transition in a different match.
These logs are diagnostics, not instructions or checked-in user data.

Composition
This additive layer includes lobby-stability/ReleaseOverlay.cmake and replaces
only the final DKRPortGame party_runtime.cpp in the external build. Existing
authored sources, submodules and generated recompiled trees are not edited.
All previous online, mod, music, save, presentation and launcher layers remain
in the chain. Both ROM revisions receive new derived peer identifiers.

Behavior
An owner-local optional (cursor, controls generation) receipt is set only by
a successfully activated release. Duplicate Go packets use this receipt,
not the cursor modified by loading/checkpoint admission. The older-epoch,
strictly older-frame, controls-generation, authenticated host, roster and
confirmed-world guards remain. A new generation can still perform a valid
seat swap at the same cursor. The receipt has no guest/checkpoint storage,
wire-format change, or mutable cross-thread access.
Added bounded release-receive and one-per-preparation diagnostics. Existing
release retry duration and failure timeouts are not increased or removed.

Regression fixture
Both OS fixtures compile the exact final production party runtime and link
the existing netplay library. A synthetic 16-byte OwnedGame substitutes for
the game; only this test translation unit exposes PartyRuntime's owner state.
The fixture invokes real scene_step(), message(), activate(), roster codec,
driver and observer playback paths. It checks repeated transitions, actual
first-frame confirmation, duplicate retries, stale frames/epochs/controls,
authority and roster rejection, same-cursor control handoff, both spectator
checkpoint/release arrival orders and host release without a watcher vote.
The unchanged prior production runtime is compiled against the SAME fixture
as a negative control and must fail the first post-load release assertion.
No ROM, guest CPU, RSP, real SDK scheduler, game or AppImage is run.

Audit and packaging
audit.py recomposes this source, validates final compiler bindings, independently
derives both peer IDs and retains every prior source/security/repair audit.
Only final-linked-identity expectations advance to the new IDs. Source backup
and hashes cover all 2,403 pre-existing authored files before this layer.
Packages use the existing complete release allowlist, not a loose executable.
No website/API deployment, release publication or automatic-update signing.

Offline-copy warning
validate_retained_merge() rejects an existing (id, Game Pak revision) whose
bank, artifact or patch identity differs from the incoming mod. This happens
after successful session admission and does not stop online play. The copy
policy and overwrite protection are preserved. Untick "Keep downloaded mods
for offline play" when testing to skip that optional operation.
