Promote develop to main: the crowd and forest world run faster in the engine (#659) - #665

…tress lab audit merge (81.99%)

…[skip ci]

Squashed from #664 at the owner's request, skipping CI. Lands the whole PRD:
one W3C standard mapping for every backend, so a game binds standard indices
and nothing else — `buttons: [0]` is the south face button on an Xbox pad, an
8BitDo and a Steam Deck.

core
- `gamepad-mappings.ts` (new): a pad the browser reports `mapping: "standard"`
  passes through; one reporting `""` is normalized from one SDL_GameControllerDB
  row per vendor:product, parsed once and cached per id; a pad no row knows is
  `unmapped` and ignored rather than read with raw indices. Four rows ship: the
  three SDL 8BitDo/Steam Deck entries, plus a measured row for the owner's
  `2dc8:3016` (SDL has none and Chromium reports it unmapped).
- `InputMap` owns the two conventions every game repeated: a radial dead zone
  (0.2, the stock Enhanced Input value, rescaled so full tilt is still 1) on both
  stick pairs, and a claim rule for which pad is read — a button press or a stick
  past half tilt claims it, the pad keeps it while idle so releases read, and a
  resting or jittering stick claims nothing. `TN_GAMEPAD` reports one line per
  connect with the id, the normalizer and the dead zone.
- `defineGame({ gamepadDeadZone })` is the named override; an out-of-range value
  throws at construction, `0` publishes raw axes.

runtime-native
- One `fillStandardPad` in `src/platform/input.cpp` replaces the two tables that
  disagreed about axes and buttons; the legacy host and the owned engine player
  now both report 4 axes and 16 buttons with the triggers as 6 and 7.

playtest
- A `gamepad` step scripts a standard pad through `navigator.getGamepads`,
  announces it as a real pad does, survives a startup reload, and refuses the
  scenario by name on lanes that cannot install one.

search and conventions
- `InputMap` carries the controller aliases, situations, constraints and the
  override; the `gamepad` convention row renders into every kit's AGENTS.md.

Proofs: input.spec.ts (dead zone, claim rule, four device rows), ctest
gamepad_standard (both entry points identical for one virtual pad),
search.spec.ts, kit-conventions.spec.ts, the platformer kit driven in a browser
by both new scenarios (x delta 28.87, jumps 0 -> 1, 0 movement at a 0.1 stick),
and the owner's physical 8BitDo read — its browser now logs
`TN_GAMEPAD {… "mapping":"table"}` and a left-stick push reads `move: [0, -1]`.

Reviewed by an independent gate over ten rounds; final `VERDICT: AUTHORIZE`.
PRD filed under `docs/PRDs/BLOCKED/requires-physical-device/` for the remaining
owner read (an official Xbox pad and a Steam Deck).