feat(atlas): the spawn atlas reads the shard, not the shard's filesystem (Phase 7)

`spawnAtlasSource.js` gains a second backend behind its existing interface
(docs/link/v8.md 10). Where a shard is linked and enabled the tree arrives over
the sidecar; where there is none, a local ServUO tree is read exactly as before.
An explicit --servuo path is an instruction and overrules both.

The parsers do not move. spawnAtlasParse.js is still pure, still fs-free and
still CI-covered without a ServUO tree anywhere near it; `buildFromFiles` is now
where the parse starts, and both readers feed it the same shape.

treeBridge.js walks the manifest and then the chunks. Three of its checks are
not decoration -- each is a way this ends in a tree that LOOKS imported, and XML
is forgiving enough that a mis-assembled spawn file parses cleanly and simply
has fewer spawns in it:

  - every chunk re-declares its address and carries the hash of its own
    uncompressed bytes, and chunks are placed by declared index rather than
    arrival order
  - the whole file is hashed after reassembly against its manifest row
  - the catalog must not move mid-walk, or the import is refused rather than
    stitched out of two trees

Boot does not call the shard. The same answer 17.7 gave the cliloc table, and
the same reasoning: a local tree hashes in ~120 ms and skips, while a round trip
in the boot sequence would answer "no" on every restart that did not follow a
map edit. Editing spawn files is an operator action, so importing is one --
Admin -> Spawn Atlas -> Import. What that costs is real and is said out loud in
the panel, the CLI and the log: an install on the bridge has NO automatic
refresh at all.

Two things the live walk found that the unit tests could not:

  - PARSER_VERSION 4 -> 5. The parse is order-sensitive in one place -- the
    decoration index keeps the FIRST item id it sees for a type -- and the two
    readers agreed on a stock tree by coincidence, since the filesystem reader
    walks each directory with localeCompare while the shard sorts whole relative
    paths. buildFromFiles now sorts by label, ordinally, once, whatever order
    the files arrived in. Identical input, a different answer for a handful of
    types: exactly what the version number exists to push through the hash gate.
    The parity test asserted deepEqual, which ignores key order; it now asserts
    serialised equality too.
  - The source fingerprint is taken over RAW BYTES at both ends. Hashing decoded
    text hashes a UTF-8 re-encoding -- identical for valid UTF-8, different for a
    file that is not, because an undecodable byte becomes U+FFFD and never comes
    back. One Latin-1 character in a creature name would have made the drift gate
    report a change on every import, forever, with the tree untouched.

A 200 from assets.sources also stopped meaning "the client files are on offer":
a shard may now serve its configuration tree while declining to serve its UO
client. Both client-file readers check `assetsEnabled` and say DISABLED, instead
of reading an empty file list as "your client has no cliloc.enu" and sending an
operator to their client install for a setting that lives on their shard.

Measured end to end against a live shard and the real sidecar: 141 files,
11.9 MB, 158 chunks, 3 pages, 1.33 MB on the wire, 512 ms; every file
byte-identical to disk; and the atlas built over the bridge identical to the one
built off it -- 6,455 points, 800 creatures, 387 regions, 558 landmarks,
25 champions, 309 decoration types.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

server/utils/assetBridge.js

@@ -153,10 +153,10 @@ async function withBusyRetry(send, what) {
  * warnings: a truncated catalogue is indistinguishable downstream from a client
  * that simply has fewer creatures.
  */
-function checkPage(page, { arrayName, cursor, pages }) {
+function checkPage(page, { arrayName, cursor, pages, noun = 'asset' }) {
   if (!page || !Array.isArray(page[arrayName])) {
     throw new AssetBridgeError(
-      `The shard sent an asset page with no ${arrayName} array`,
+      `The shard sent a ${noun} page with no ${arrayName} array`,
       'MALFORMED',
     )
   }
@@ -164,7 +164,7 @@ function checkPage(page, { arrayName, cursor, pages }) {
   if (!page.more) {
     if (page.cut !== 'end') {
       throw new AssetBridgeError(
-        `The shard stopped sending assets after ${pages} page(s) (cut: ${page.cut || 'unknown'})`,
+        `The shard stopped sending ${noun} rows after ${pages} page(s) (cut: ${page.cut || 'unknown'})`,
         'INCOMPLETE',
       )
     }
@@ -173,7 +173,7 @@ function checkPage(page, { arrayName, cursor, pages }) {
 
   if (!page.cursor || page.cursor === cursor) {
     throw new AssetBridgeError(
-      `The shard asked for another asset page without advancing its cursor (${page.cursor || 'none'})`,
+      `The shard asked for another ${noun} page without advancing its cursor (${page.cursor || 'none'})`,
       'STUCK',
     )
   }
@@ -181,6 +181,17 @@ function checkPage(page, { arrayName, cursor, pages }) {
   return { done: false, cursor: page.cursor }
 }
 
+/**
+ * SHA-256 of a buffer, lowercase hex.
+ *
+ * Here rather than in each caller because the shard's `BridgeAssets.Sha256Hex`
+ * is one function on its side too, and a hash that has to match across a wire
+ * should have exactly one spelling at each end.
+ */
+function sha256Of(buffer) {
+  return require('crypto').createHash('sha256').update(buffer).digest('hex')
+}
+
 // The client files the body catalogue is derived from. `assets.sources` reports
 // every file the shard can see; these are the ones that decide a sprite.
 //
@@ -218,6 +229,18 @@ async function sourceFingerprint() {
   const res = await uoLinkClient.getAssetSources()
   if (!res.ok) throw describeFailure(res, 'client file manifest')
 
+  // A 200 from this call stopped meaning "client files are on offer" in phase 7:
+  // it now answers whenever either plane is enabled, so a shard serving only its
+  // configuration tree reports an empty file list rather than a 403. Read as-is
+  // that becomes "your client has no animation files", which sends an operator to
+  // the wrong place entirely.
+  if (res.data?.assetsEnabled === false) {
+    throw new AssetBridgeError(
+      'The shard is refusing to serve client assets (Bridge.AssetsEnabled is off)',
+      'DISABLED',
+    )
+  }
+
   const wanted = new Set(SOURCE_FILES)
   const files = {}
 
@@ -564,6 +587,12 @@ async function resolveBodies({ creatures } = {}) {
 
 module.exports = {
   AssetBridgeError,
+  // Shared with `treeBridge.js` (phase 7): the 425 backoff, the page-envelope
+  // checks and the hash are properties of this PLANE, not of the body family, and
+  // a second copy of any of them is a second place for the envelope to drift.
+  withBusyRetry,
+  checkPage,
+  sha256Of,
   FAMILY,
   BODY_CHUNK,
   FETCH_CHUNK,