merge: absorb upstream/main into the Turtle fork

Fork policy (docs/METHOD.md): upstream structure wins; local-unique work
re-applied on top. This commit is the upstream half of the reconciliation.

Upstream is the same program at a rewritten history (884dff77 == 4e0e89cb
tree), so the merge base was replaced to keep a real three-way diff. The
large conflicts are upstream moving first: the UI manifest (benilla.toc ->
the binary LAYER_MANIFEST/layer.toc split), the CVar table (cvars.rs ->
cvars/{mod,table}.rs, +24 video rows), the editbox flush model, the
host-side GetTime, the Options* -> BenillaOptions* rename, expanded
ui_unit.rs, and a rebuilt volumetric_light.rs.

Local-unique pieces re-instated on the upstream structure:
- OptionsFrame.xml: the 1.12 OptionsFrameSliders table restored under the
  Benilla rename, with the TurtleWoW deviation note (patch-4 replaces
  OptionsFrame.lua).
- layer.toc: CharacterFrameAdapters.xml (the sixth TurtleWoW character tab).
- ui script: wipe/sizeof, BenillaGetMerchantItemStats, and the attach/mount
  teardown re-walk all survive.
- game_plugins.rs keeps UPDATE_ACTIONABLE_CEILING=5_509 (re-measure pending).

The LFT/Turtle_TransmogUI rows benilla.toc named off the player's install
now come from the chain's own FrameXML.toc via the new core loader.

reference/README.md

@@ -37,8 +37,12 @@ the reference client's `_G`, which is not in this repo, so it is a manual regene
 stable: it describes a client that shipped in 2006.
 
 Reading it: `scripts/api-coverage.sh` asks a real `UiScript::new()` what benilla exposes and reports
-`have / missing / beyond-1.12`. `crates/benilla-ui/src/script/tests/reference_surface.rs` is the
-gate: it fails if benilla grows a global that 1.12 does not have and nobody wrote down why.
+`have / missing / beyond-1.12`. Two gates hold the line.
+`crates/benilla-ui/src/script/tests/reference_surface.rs` fails if the engine puts a global 1.12
+does not have in a bare VM and nobody wrote down why, with no prefix excusing an engine name.
+`crates/benilla-app/src/ui_script/surface_gate.rs` fails if the production load, the core and
+benilla's layer, adds any global past 1.12 other than the layer's own `Benilla`-prefixed names, or
+any widget method.
 
 ## `1.12-shapes.tsv` and `1.12-events.tsv`