Migrate hotbar HUD to Lua with protected native hotkey dispatch

User requested design before implementation: migrate hotbar HUD presentation to XML/Lua with maximum presentation flexibility without Lua gameplay automation. User authorized implementation of the shared secure-interaction system and migration of existing windows. Current slice excludes the Lua hotbar presentation migration, which follows separately. No commits authorized. Checkout /home/mathias/Projects/engines was clean at investigation start. Inspected current ShortcutBars model, ShortcutBarPresenter, ShortcutBarsController, CharacterInterface hotbar construction/input handlers, InputActionRouter, LuaWidgetHost activation, ScriptedActionsWindow capability adapter, package documentation, QuickHotbarBinding and chat command dispatch. Native hotbar currently combines persistence, item reconciliation, shortcut execution, pointer drag/hold/drop, and presentation snapshots. InputActionRouter intentionally dispatches all matching actions; existing press triggers suppress keyboard repeats. LuaWidgetHost captures a widget binding on activation and permits one matching command, but that alone cannot stop Lua choosing/replacing an action before the input. Proposed design for user review: native-owned committed shortcut configuration and a shared protected input dispatcher; Lua owns composition, styling, cooldown formatting and HUD presentation. Native resolves physical input to an exact committed descriptor before observers, dispatches through current special/perk/item/nano/chat controllers, and never asks Lua to choose the action. No arbitrary executable Lua hotkey callback, synthetic clicks, saved input tokens, retry/fallback or key-repeat authorization. User chose combat lockdown rather than always-protected configuration. Out of combat, Lua may configure slots, bindings, layout and macro definitions without an explicit editing gesture. Physical input is still required for execution; no autonomous actions. On native combat entry, freeze protected configuration before Lua observers run. In combat, row/bar selection remains available through predefined native player-input operations, not arbitrary Lua mutation. Native retains item-follow reconciliation under existing rules, with combat-time behavior to be traced so it cannot redirect a captured action. Agreed protection is combat-scoped: binding identities, macro contents, protected hit-target geometry/visibility/z-order and routing eligibility cannot be changed by arbitrary Lua during combat. Rendering-only updates (cooldowns, counts, text, styling) remain live. Protect relevant parents as well as slot nodes so reparenting/hiding/moving a container cannot bypass lockdown. Native owns combat status; Lua cannot toggle it. Out-of-combat state-driven configuration is intentionally permitted; this is not a promise to prohibit every out-of-combat decision aid. Reject combat-time mutations rather than automatically queueing them for replay; Lua can configure afresh after combat. Existing ClientTargetingState.IsInCombat covers local fighting or another known character fighting the player; use native session state, never Lua flags. Trace input/update ordering and read the native state at protected mutations/dispatch, rather than relying on a later presentation snapshot. Secure action identity/key labels need trustworthy native presentation. Hidden bar hotkeys should retain existing semantics independent of Lua visibility. Scope and compatibility policy for existing duplicate gameplay bindings need user agreement: recommend one protected hotbar action per physical press, without changing unrelated movement/UI fanout or native game command semantics. Existing native text macros are retained; their committed text is captured for execution, and macro edits are blocked during combat. No new sequences, waits, conditional dispatch language or execution-time Lua substitution. Secure system merged through PR2849. Hotbar presentation implementation is committed as 993764ac0 (`feature: Move hotbar presentation to Lua`) on branch feature/lua-hotbar-hud from merged origin/develop b23be52d4, pushed to origin and merged through PR https://git.project-rk.com/prk/engines/pulls/2854 into develop on 2026-10-24. ShortcutBarPresenter and global ShortcutBar/ShortcutSlot layouts are removed. Independent ScriptedShortcutBar + UI/Packages/Hotbar XML/Lua instances now own composition, orientation, controls, row/active presentation and ten slots while native ShortcutBars, ShortcutBarStore, ShortcutBarsController and InputActionRouter retain authoritative state, persistence and execution. RequiresActivation exports now generate exact native command registrations; direct Lua calls always return false. ui.action configures command+reference+physical button out of combat, and native dispatch precedes nonactivating Lua observers. Native Escape invokes the configured close action directly, without synthesizing a click. Existing native hotbar handlers use InputActionRouter.OnProtected (one protected registration per press, no conflicting fallback); no Lua hotkey callback API was introduced. Combat gates use ClientTargetingState.IsInCombat directly at host calls and input, not a Lua snapshot flag. Root layout and hit-test eligibility freeze independently of cosmetic opacity/tooltips; native movement/scroll transforms and predeclared close/pin/menu operations remain available. Lua tabs/sorting/grid-list/new controls are intentionally locked until combat ends. Core grids/tables/rosters keep semantic identities pinned and present latest facts on unlock, without replaying commands. Native item references renew for the same positions; surviving pet/team/perk/nano-program/effect references retain semantic identity. Removed subjects remain invalid; protected presses are revoked on native context renewal. Review found and reproductions confirmed opacity-based target substitution (Attack became Brawl), a second tooltip-based target-substitution path (Attack became Walk), double scrolling, stale NCU effect references and local inventory close binding mismatch. Fixes separate frozen hit-test eligibility from rendering, preserve unscrolled layout coordinates, retain surviving effect references, revoke effect-replacement presses and leave local-close bindings untouched. Native reference renewal was refined not to cancel an unrelated native item stack-splitting gesture. Native close controls no longer run a duplicate Lua close fallback. Secure-interaction slice committed as a54607a3b (`feature: Add secure Lua interactions`), pushed to origin/feature/secure-lua-interactions and merged in PR https://git.project-rk.com/prk/engines/pulls/2849 to develop on 2026-10-24. User confirms the PR was tested on all supported platforms before merge. Verified shared-system/existing-window milestone: full client suite with warnings as errors 4154 passed/185 install-dependent skipped/0 failed; GraphicsEngine 714 passed/1 skipped/0 failed. ./run-client-lua-tests.sh passes native Release 8/8, ASan/UBSan 8/8, generator self-tests, bridge Linux x64 NativeAOT and production UI Linux x64 NativeAOT. AOT UI check now exercises combat command-lock and cosmetic hit-test isolation. git diff --check clean. Final static security/maintainability/verification agents found no verified defects; correctness/testing agents hit review turn limits, so the last review is explicitly partial. Earlier complete reviews produced material findings, all reproduced red and fixed green. AOT allocation regression (32 bytes per unchanged Skills refresh) was isolated to RefreshProtection, not availability iteration: removing availability refresh did not change it; per-method diagnostic measured protection=32000, availability/input/session=0 over 1000 calls. Moving transition-only callback closure construction to a separate method restored the existing zero-allocation AOT test without weakening it. Temporary diagnostic/control edits removed. Mutation controls were observed: allowing protected-action configuration during combat breaks the pet Primary-to-Follow test; allowing protected key fanout/fallback breaks both hotkey policy tests. Secure-interaction implementation is merged through PR2849 and user-confirmed across all supported platforms. Keep the task in progress only for the separate Lua hotbar presentation migration; the secure-interaction/existing-window milestone is complete. Logs under /tmp/prk-secure-*.log. Reuse ShortcutBars/ShortcutBarStore, action catalog/keybinding/capture infrastructure, current gameplay controllers and LuaUiComponent/widget/window/preferences/generator pipeline. Split ShortcutBarsController responsibilities rather than creating a parallel Lua model; replace ShortcutBarPresenter with ScriptedShortcutBar, not a native fallback. Each bar gets an independent package instance with stable native references for ten logical slots and its active/previous/next controls. Lua owns structure, orientation, labels and slot visuals; native pointer gesture handling continues to resolve semantic references for dragging, quick binding and spinner right-click orientation. Slot execution and row/bar controls use exact ui.action native dispatch. Native hotkeys continue resolving the same authoritative model directly. Retain native pointer gesture state machine and generic slot registration bridge for native drag/drop, Shift inspection, context removal, quick binding and cursor feedback. Lua owns bar/slot construction, orientation/layout and visual updates; protected routing/layout is mutable out of combat and locked against arbitrary Lua changes during combat. Implemented hotbar behavior: slot/active/previous/next controls use exact ui.action native references; Lua may recompose and remap complete semantic routing out of combat. Native SlotAt/SlotOf and quick labels follow binding revisions atomically. Combat permits preconfigured click/hotkey slot execution and native active/row selection while refusing Lua remaps, drag/drop, add/remove, macro creation, orientation changes, quick binding and bar dragging. Combat initialization retries protected setup on unlock. Failed/incomplete packages become nonconfigurable with diagnostic containment and safe quick-binding teardown; no native presentation fallback. Native gesture transactions now snapshot every touched cell across chained occupied-slot swaps. Forced combat/lock/input reset/disposal rolls the transaction back before saving; successful empty placement commits. Saves defer while a transaction is pending, external additions are refused, macro definitions remain referenced and item reconciliation waits until commit/rollback then applies the latest inventory revision. Native code forces the hotbar-only combat drag marker independent of package XML. Spinner right-click follows the current semantic spinner binding, including custom replacements. Acceptance: existing active/per-bar keys, row selection, all shortcut kinds, macros, drag/hold/swap/removal, locking, inspection, quick binding and persistence preserved subject to agreed conflict policy; no arbitrary Lua state-driven remapping during combat or autonomous execution at any time; no input reuse across callbacks/packages, repeats, focus/reset/capture/session changes; stale descriptors cannot redirect; snapshot/observer/coroutine calls never execute. Verified current branch: full client suite with warnings as errors 4162 passed/185 install-dependent skipped/0 failed; GraphicsEngine 714 passed/1 skipped/0 failed; native Lua Release and ASan/UBSan 8/8 each; generator self-tests, bridge Linux x64 NativeAOT and production UI Linux x64 NativeAOT pass. New AOT acceptance covers XML/Lua composition, symbolic slot presentation, controls, combat dispatch, orientation, zero-allocation unchanged apply and teardown. Targeted hotbar suite has 42 tests after red/green review corrections. git diff --check clean. Final complete static review found no actionable issues. User confirms the hotbar migration was verified and merged. The protected interaction foundation and Lua hotbar migration are complete. Measure unchanged-update allocation behavior with a control if making performance claims. No addon manager, macro language expansion or unrelated window migration.