bone_sse: fix 3 more bugs from assembly verification (#15-17)

Bug #15: Short-value interpolation read AD+0x0C (nTimestamps count) as
pointer to short array. Should be AD+0x18 (ofsValues). Caused segfault
reading from address ~0x134 (a count value treated as pointer).

Bug #16: boneKeyframeLoop AnimData offsets wrong. Rotation was kf_data+0x10,
should be +0x1C. Scale was kf_data+0x28 with garbled gate, should be +0x38
with gate at +0x44. Translation was correct at +0x00. Entry structure is
3x28-byte AnimBlocks: trans(+0x00), rot(+0x1C), scale(+0x38) = stride 0x54.

Bug #17: particleEmitterLoop (model_hdr+0x124) position AnimData was
entry+0x04, should be entry+0x10 with gate at entry+0x1C. Second track
was entry+0x20, should be entry+0x38/gate +0x44. Third track at
entry+0x60/gate +0x6C was missing entirely.

Also fixed IsParticleBufferEmpty calling convention (bug #14):
was __stdcall with stack param, now __fastcall(ECX=ptr) plain RET.

SSE dispatch enabled for A/B testing.

src/transform44/transform44.zig

@@ -236,9 +236,11 @@ fn transformDetour(this: u32, edx: u32, mat1: u32, mat2: u32, mat3: u32, mat4: u
     t44_depth +|= 1;
     if (t44_depth > prof.t44_max_depth) prof.t44_max_depth = t44_depth;
 
-    // bone_sse disabled while verifying from assembly
-    _ = transformMatrix4x4_SSE;
-    transform_hook.callOriginal(.{ this, edx, mat1, mat2, mat3, mat4 });
+    if (ab_use_custom) {
+        transformMatrix4x4_SSE(this, mat1, mat2, mat3, mat4);
+    } else {
+        transform_hook.callOriginal(.{ this, edx, mat1, mat2, mat3, mat4 });
+    }
 
     t44_depth -|= 1;
     const elapsed = rdtsc() - start;