feat(assets): a creature's picture is whichever action has one (Phase 6)

The shard's catalogue can now answer for 73 bodies it used to report absent —
they have no art at action 0 and real art at a later one, and their key says
which (`body/820/a23` is a horse). This side stores that action and stops
assuming `a0` anywhere.

The atlas join is the part that mattered. It read

  a.asset_key = CONCAT('body/', b.body, '/a0')

which would have silently dropped exactly the creatures this phase adds. It now
reads the row's own action, with COALESCE for rows written before the column
existed — a NULL inside CONCAT makes the whole comparison NULL, which would have
taken every portrait off the site on upgrade with the database perfectly correct
and nothing in any log. It still matches at most one row per slug: a deeper key
(`body/820/a23/f4`) does not equal the catalogue key.

Verified against a real MariaDB with the live shard's own 1,095-row manifest: the
ALTER applies to an installed-shape table and is idempotent, the horse joins to
its a23 picture, a pre-phase-6 NULL-action row keeps its portrait, and a stored
frame key does not become a second candidate.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

server/model/shardAssets/shardAssets.model.js

@@ -25,7 +25,13 @@ const log = require('../../core').logger('shardAssets')
 // **The catalogue** (§4.8, §11) is one thumbnail per creature body: the shard
 // walks bodies 0–2047, validates each index entry, decodes the ones that are real
 // and hands back `{ key, sha256 }` first and the PNG second. On a stock client
-// that is **787 sprites**, not the 1,144 the decoder claims — see below.
+// that is **1,095 sprites** — 787 out of the legacy anim files, 235 more out of
+// the UOP packages (phase 4), and 73 more since phase 6, which have no art at
+// action 0 and real art at a later one. Never the 1,144 the decoder claims.
+//
+// A key therefore names its action — `body/820/a23` is a horse whose action 0 is
+// empty — and the key is still one per body. Nothing here treats `a0` as the
+// shape of a body key; the atlas join reads the row's own action (§11.2).
 //
 // **Body resolution** (§8) is the join. The atlas knows a creature by the class
 // name in `Spawns/*.xml`; the client knows it by a body id; nothing in the ServUO
@@ -296,6 +302,7 @@ async function importAssets({ force = false, approve = false } = {}) {
       width: got.width || row.width,
       height: got.height || row.height,
       body: got.body ?? row.body,
+      action: got.action ?? row.action ?? 0,
       direction: got.direction ?? row.direction,
       file: name ?? existing?.file ?? null,
     })