Complete IRON RAIN redesign and refresh all website captures

[ralyodio]

Ships one consistent IRON RAIN art set across the playable game and website gallery while preserving the approved first-person C7.

• Replaces all 27 other runtime GLBs with original structures, vehicles, equipment, world weapons and two animated operators. Removes obsolete models and nine old texture maps.
• Integrates the new surface atlas, asphalt terrain, industrial daylight, effects, deployment menu and field HUD. The approved m2_carbine_fp.glb and its three texture maps remain unchanged.
• Verifies combat with four enemies and three friendlies: spawning, movement, incoming fire, damage, death and respawn.
• Regenerates all ten website screenshots with tools/art/capture.mjs from published game commit f2f77774c6ebe54d4a8421653f4025da175d90a8. Replaces every old image, uses content-hashed filenames and updates provenance.
• Fixes an obstructed pipe-lane photo camera and adds a regression test ensuring every capture camera is outside solid map geometry.
• Includes reproducible art tools, asset hashes, provenance and the browser smoke report.

Validation completed locally:

• 278 tests passed; workspace TypeScript checks, formatting and lint passed.
• All 28 GLBs validated with zero errors and zero warnings.
• Game and site production builds passed; final site TypeScript check passed.
• Chromium 143 / SwiftShader smoke test loaded all 28 expected models, showed seven combatants, verified firing killed an enemy, and verified combat pauses at the gate. This test uses a headless pointer-lock/input adapter.
• All ten final 1600 × 900 captures were visually reviewed and checked against their hashes and source revision.
• Runtime model/texture/effect-audio inventory is 7.0 MiB, within the existing 9 MiB asset budget.

Review: model overview, combat preview, browser report, screenshot provenance.

Targets main for review. No automatic merge or production deployment has been performed.

[github-actions]

ThreatCrush Security Scan

9 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 5

Severity	Rule	Location
HIGH	manifest-typosquat	apps/game/package.json:17
HIGH	sh-remote-script-execution	apps/site/public/install.sh:210
HIGH	sh-remote-script-execution	apps/site/public/install.sh:213
HIGH	sh-remote-script-execution	apps/site/public/install.sh:216
MEDIUM	sh-remote-script-execution	apps/site/public/install.sh:219
MEDIUM	sh-remote-script-execution	apps/site/public/install.sh:432
MEDIUM	sh-remote-script-execution	apps/site/public/install.sh:433
MEDIUM	js-path-traversal	tools/art/tactical-sample/validate.mjs:6
MEDIUM	js-path-traversal	tools/art/tactical-sample/validate.mjs:10

Snippets are redacted; ThreatCrush never prints matched credential material.