Add live memory discovery and structured telemetry

[eric-levinson]

Summary

• adds bounded read-only private-memory scanning and batch reads to the injected CFB27 Lua host
• replaces the initial whole-process scan with deterministic 32 MiB cursor-paged traversal across full region tails
• adds typed SDK page/aggregate APIs and developer CLI memory scan/read commands
• adds registered, bounded structured telemetry through cfb.emit(type, payload)
• packages the repository as the 0.2.0-dev.1 developer preview with explicit native artifact selection

Why

The Brooks recruiting integration needs a safe main-process bridge for discovering and validating live recruiting structures. The first live gate showed that a one-shot scan could not cover CFB27's multi-gigabyte private address space: it stopped after 512 MiB, skipped large-region tails, and could exceed the SDK timeout.

This PR fixes the root cause with resumable pages, exact continuation cursors, chunk-boundary overlap, strict progress validation, and a bounded named-pipe retry that never duplicates a sent command.

Safety boundary

• offline-only developer tooling
• read APIs only; this PR adds no memory-write protocol or renderer/preload exposure
• exact supported-build gate, with explicit diagnostic override for read-only unsupported-build inspection
• canonical string addresses rather than JavaScript numbers
• bounded page, chunk, context, range, telemetry depth/count/string, and aggregate limits
• every candidate must be re-read and validated because live allocations can change
• no anticheat bypass

Runtime verification

A fresh supported offline Dynasty session completed a full paged scan of 10,670,854,144 eligible bytes in 69,379 ms across 319 derived pages. Three sentinel candidates were returned; two re-read with the exact 16 bytes and one transient copy changed and was correctly rejected.

Registered telemetry emitted exactly once with an advancing cursor. The game remained responsive through Recruiting -> Dynasty hub and a 639-second watch with the same PID, advancing ticks/events, and no host error. No memory write was attempted.

The runtime document distinguishes the manually tested pre-version-bump host hash from the final automatically rebuilt/smoke-tested host.

Validation

• npm run check
• npm test — 62/62
• full Windows x64 Release configure/build
• startup, memory-reader, telemetry, and framed-protocol smokes
• protocol smoke against the staged packaged host
• explicit CFB27_NATIVE_ARTIFACTS package input
• staged DLL hashes equal the Release build hashes
• internal stage checksums and external ZIP checksum verified
• forbidden package/archive content scan: zero findings
• multiple independent task and whole-branch reviews: no remaining Critical or Important findings

Follow-up

Guarded compare-before-write transactions and Brooks recruiting calibration remain separate follow-up PRs. This draft should not be tagged or published until review, merge, and the release checklist are complete.