the spell owns its state, and a malformed file is refused, not a crash

- the spell owns its lifecycle state: the in-flight cast, the local cancel, the cooldowns and the spell-modifier tables live in one module (2328)
- a malformed MPQ, DBC, M2 or WDT file is refused instead of crashing the client, nine read sites bounded
- a test that needs the install or the addon corpus fails instead of skipping when the data is there; the Bagnon render suite runs again (2329)
- the dev crash injector is armed on every platform, and no instrument writes a path relative to the working directory

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -513,7 +513,6 @@ dependencies = [
  "benilla-formats",
  "benilla-protocol",
  "benilla-ui",
- "benilla-wmo",
  "benilla-world",
  "bevy",
  "bevy_egui",
@@ -674,7 +673,6 @@ dependencies = [
  "bevy",
  "bytemuck",
  "image",
- "libc",
  "objc2 0.5.2",
  "objc2-app-kit 0.2.2",
  "objc2-foundation 0.2.2",