Fix secure Lua combat-time NCU, loot and Skills usability

Allow server-driven NCU additions/removals and loot population during combat, including actual buff cancellation and looting from physical input. The Skills window must also remain fully usable during combat, including category/skill navigation and validated IP spending. Preserve secure Lua restrictions against script-driven command remapping or activation, and reuse existing UI components. Acceptance: regression tests reproduce both problems before the fix; NCU and loot stay current in combat; security regressions and relevant client/graphics tests pass. Live-game verification must be reported separately. Implementation: native-owned row-template collections reconcile combat-time NCU/item membership and commands without exposing Lua rebinding authority. Existing surviving controls stay pinned; new controls receive native bindings, removed subjects lose authority, and native scroll-content reflow reaches overflow rows. Window construction/configuration finishes before lockdown. Skills alone opts out of combat layout lockdown while retaining activation-bound save/reset/confirmation and native draft/session validation. Verified so far: initial NCU/loot regressions failed before implementation; disabling native collections and restoring Skills lockdown produces 12 regression failures; removing native layout requests produces three failures; removing grid scroll-height reconciliation fails the overflow regression. Mutations restored. Final client suite passes 4,179 tests with 185 asset/environment-dependent skips; graphics suite passes 711 with one skip. Final native Lua release/sanitizer tests, API generator self-test and both Native AOT harnesses pass. git diff --check passes. Broad whitespace checks report 29 diagnostics on unchanged baseline lines across ScriptedItemContainerTests.cs and LuaUiComponent.cs, with zero diagnostics on changed lines; unrelated formatting was left untouched. Implementation and regression validation are complete. Committed as 5f73655f8 on fix/client-combat-window-updates and pushed with upstream tracking. Pull request #2864: https://git.project-rk.com/prk/engines/pulls/2864 (base develop). No live-game or Windows verification has run; the player should perform another in-game combat pass.