Add shared Lua capabilities needed by Stats, NCU and Nano Programs migrations

User requests a dedicated fourth Pi/Herdr session to own shared infrastructure and unblock three parallel window migrations. Worktree /home/mathias/Projects/worktrees/engines-client-lua-shared-capabilities; branch feature/client-lua-shared-capabilities; common base adde9d039997805fcd0090e4c75f63a8d8589449 (merged develop). Shared implementation and local acceptance are complete. Published commit 258ea244c on feature/client-lua-shared-capabilities; PR https://git.project-rk.com/prk/engines/pulls/2803 is open against develop. User will handle merging. No peer worktrees or CharacterInterface hunks were changed; no merge or peer restart. No unchanged expensive suites or optional review were rerun for publication. All three dependent migrations remain blocked until the coordinator integrates these changes. User explicitly stopped the optional review pass; it was aborted and no review result is claimed. Exact integration handoff: - Stats: ui.progress(widget, fraction) rejects nonfinite values and clamps finite values to [0,1]. Window.create options horizontal='center', y=10 preserve its initial placement; horizontal/vertical accept start|center|end. ui.window.align(frame,horizontal,vertical) retains offsets. Existing native persistence and pointer drag paths remain authoritative. - ui.window.on_visibility(frame, callback(visible)), or Window.create on_visibility option, queues native root close/Escape/session/reopen transitions in order without recursive Lua calls or command activation. Replacement invalidates pending previous-generation notifications; destroy/dispose unsubscribe/release. IMPORTANT: call LuaUiComponent.Refresh in normal update even when hidden or snapshots are unchanged, so native-only visibility transitions flush. No CharacterInterface presentation relay. - ui.on_text_changed(widget,callback(text)) receives native edits only; ui.text does not synthesize events. ui.on_drag_start(widget,callback()) and ui.on_drag(widget,callback(totalHorizontalOffset)) use existing column_resize='true' native handles/capture. Observers never authorize commands. Nested observer calls copy owned managed arguments into a bounded queue and check callback liveness; no native ABI expansion or borrowed Lua values. - ui.on_pointer_release(widget,'right',callback()) provides native matching pressed/released provenance and right-button identity. ui.on_click remains left/keyboard. Generated RequiresActivation now accepts one declared integer opaque descendant of Binding, not Binding itself or arbitrary scalars. ActivationButton='right' selects cancellation; default 'left' keeps Actions. BREAKING native policy signature: AuthorizeLuaActivation(long token,string button), delegate to Widgets.ConsumeActivation(token,button). Actions updated. Permission is synchronous, single-use, captured before callback, button-specific, and rechecks CanInteract plus effective visibility/enabled/owned-root membership at consumption. Keep identity/membership/removal/casting rules in peer adapters; do not reuse ActionRef for nanos. - ui.opacity(widget,finite[0,1]); ui.overlay(widget,nativeIdentifierOrEmpty) bounded to256 UTF8 bytes/no paths; ui.text_color(widget,'#RRGGBB'|'#AARRGGBB'|'') uses native retained properties/resource drawing. - local Preferences=ui.require('core.preferences'); Preferences.read_array(path,kind), write_array(path,values,kind), kind text|float. Preserve listview_config.col_id / col_width. Limits128 entries,256 UTF8 bytes/entry, finite floats,64 scoped keys; whole-array replacement preserves nested/unrelated archive fields. Wire LuaWindowServices.ReadPreferenceArray=(key,kind)=>store.ReadUiArray(identity,key,kind), WritePreferenceArray=(key,encoded,kind)=>store.WriteUiArray(identity,key,encoded,kind). Low-level read_array_encoded/write_array_encoded use scalar concatenated UTF8 length:payload values, not table transfer. Empty string encodes an empty array. Keep per-window identity captured natively. - NCU rectangular sizing belongs in package-local Lua with core.window; core.icon_grid remains Actions' square-grid helper. No extra shared grid API needed. - Guides updated at PRK.Client/LuaApi/README.md and PRK.Client/PRK.Client/UI/Packages/Core/README.md. Generated bindings/docs remain obj/publish output, not tracked files. Final verification (restored implementation): full ./run-client-tests.sh with warnings-as-errors reports 4000 passed,180 skipped,0 failed; full PRK.GraphicsEngine.Tests reports704 passed,1 skipped,0 failed. ./run-client-lua-tests.sh exits0: native Release8/8, ASan/UBSan8/8, generator self-tests, scripting NativeAOT and shared UI/Actions NativeAOT all pass. Existing unchanged-snapshot allocation assertions pass. Eleven deliberate behavior mutations fail as intended: progress mutation, nested archive preservation, single-use, button matching, consumption-time session revocation, release provenance, captured binding/rebind, copied observer args, callback liveness, visibility generation, teardown. All restored before final suite. git diff --check clean. Logs in ignored .dev-data/shared-full-client.log, shared-full-graphics.log, shared-aot-final.log; mutation-*.log. Targeted shared tests19/19 also pass. Optional fast managed capability harness: dotnet run --project PRK.Client/PRK.Client.UI.AotTests -c Release -p:PublishAot=false -- --shared-capabilities. Default runner still requires actual NativeAOT. Limits: Linux x64 local container validation only; Windows/macOS/remote CI/live game rendering not executed. Full-suite skips are unavailable installed assets/native display/audio/runtime fixtures and an existing ignored graphics test. Peer domain migration integration and their own acceptance remain outstanding, not claimed unblocked. Do not edit peers' worktrees or overwrite their uncommitted work. Publication authorized; merge reserved for the user. Load dependency task descriptions for exact observed needs and evidence: Stats tsk_sur784eg27 (native data extraction done,59 tests pass/3 skips); Nano Programs tsk_26fvmaj77c (audit only,109 pass/2 skips); player NCU tsk_5vbhg5k793 (native validated command extraction done,390 pass/19 skips). All are blocked and must not be marked unblocked until capabilities are actually integrated into their branch/worktree. Herdr names lua-stats, lua-nano-programs, lua-ncu; dedicated shared agent will be lua-shared-capabilities. Scope: own shared Core components, LuaWidgetHost/runtime, callback/activation abstractions, API contracts/attributes/generator, necessary graphics/input/window manager hooks, scoped preferences and shared tests/AOT harness. No feature-window presentation, domain data/casting/cancellation mechanics or peer CharacterInterface hunks. Reuse existing abstractions and avoid proliferating per-window capability implementations. Prioritize Stats: generic finite bounded progress fill; owned window visibility callback driven by actual native close/Escape/session state, deferred until safe/nonreentrant and cleaned up on replacement/destroy/dispose; initial validated frame alignment preserving native saved placement and later drag behavior. Common input/security: package-owned real text-change callbacks, opacity, native column drag-start/drag offsets, right-button pointer-release provenance, and generalized RequiresActivation for declared Binding-derived opaque game refs. Preserve native pressed==released proof, physical button, captured pre-callback binding, one-use authorization scoped to synchronous real user activation, CanInteract/session/visibility checks, no permissions from text/drag/resize/menu/visibility/apply/observer callbacks and no rebind/stale-callback loophole. Domain adapters still validate current identity/membership/removal/casting rules; do not implement game facts or reinterpret domain commands here. Presentation/preferences: bounded borrowed overlay graphic and text-color updates; generic scoped arrays preserving existing text col_id/finite float col_width archives with whole-array replacement and unrelated fields preserved. Current host ABI accepts scalar/callback arguments and scalar replies: prefer a safe bounded scalar protocol composed in Lua when sufficient; do not add unsafe C# access to Lua state or invent table transfer that the bridge does not support. Any necessary ABI/runtime extension must preserve/reprove native protection, memory/lifetime, OOM/error/budget/AOT invariants. NCU rectangular sizing may remain package-local Lua rather than expanding Core; only add reusable support if actual consumers justify it. API names requested by workers are proposals, not mandatory shapes. Inspect existing implementation and agree on a coherent minimal surface that meets behavior; avoid speculative feature stubs. Update generated API metadata/docs and concise component guide. Preserve Actions behavior and unchanged-update allocation guarantees; no reflection, direct game commands from generic UI, disabled tests or new safety suppressions. Acceptance: precise supported API surface addresses all required worker blockers or explicitly records remaining gaps; real native-input/lifecycle/provenance regressions and negative controls pass; full relevant client/window tests, generator self-tests, native Release+ASan/UBSan and Linux NativeAOT acceptance pass where practical. Retain Windows/macOS/live limitations and actual results. Publish a concise private handoff with agreed signatures, ownership/security semantics, tests and safe integration instructions. Leave peers blocked until user/coordinator integrates validated changes; do not alter their task statuses or cherry-pick into dirty trees. Keep private tracking data out of repository/team artifacts.