feature: CS2FOW anti-wallhack integration

[Flegma]

Integrates the CS2FOW server-side anti-wallhack Metamod plugin (pinned v0.1.1-preview, SHA256-verified).

• Image installs addons/cs2fow + metamod VDF into /opt/addons; baker toolchain in /opt/cs2fow-tools; repo-owned cfg/cs2fow.cfg
• setup.sh: AVX guard (fail-open), per-node persistent bakes on the serverfiles volume (BASE_SERVER_DIR/.cs2fow), tools symlinks, cfg copy
• update.sh: one-time per-node official-map prebake fetch (SHA256-verified, non-fatal, AVX-gated), preserving the steamcmd exit code
• FiveStack plugin: new anti_wallhack match option (default true), applied via cs2fow_enable at setup and go-live, antiWallhackStatus event published per map

REBASED onto the mono-repo restructure (#163): plugin changes live in apps/counterstrikesharp/, the entity in shared/dotnet (deserialized by both apps; swiftly ignores the field), the prebake block in shared/scripts/update.sh env-guarded so the swiftly image (no CS2FOW_PREBAKE_URL) skips it.

Follow-up for lukepolo: CS2FOW parity for apps/swiftly (this PR wires only counterstrikesharp); and the fork/mirror question for the upstream repo remains open per the design doc.

Design: docs/plans/2026-07-09-cs2fow-anti-wallhack-design.md (5stack local docs)
Part 1 of 3; merge before the api and web PRs.

[Flegma]

Max-effort code review completed on the rebased branch (10 finder angles, adversarial verification, gap sweep). Confirmed findings fixed in 106b8c7:

1. Stale anti-wallhack status: ApplyAntiWallhack re-runs on every match-data redelivery (e.g. kill-switch flip + sendServerMatchId on a Live match) and can flip cs2fow_enable mid-match, but the status event only fired at go-live. PublishAntiWallhackStatus now also fires on setup passes; the api processor is an idempotent overwrite.
2. Latent dangling-symlink bug: the hand-rolled tools loop created a literal '*' symlink if /opt/cs2fow-tools were ever empty (reproduced in a sandbox). Replaced with the existing create_symlinks helper from util.sh, which also removes the duplication.
3. Docker image dead weight: the staged CS2FOW extraction shipped ~125 MB in a layer that a later RUN only whiteouted. Download/verify/extract/install/cleanup now happen in one RUN placed after the addons assembly (verified via isolated build: artifacts present, staging gone).
4. update.sh now exits with UPDATE_RC defaulting to 1 (fail closed if a future path forgets to set it; behavior-neutral today).
5. Observability: ApplyAntiWallhack logs when CS2FOW is not loaded; PublishAntiWallhackStatus warns if the maps directory itself is missing while the plugin is loaded (distinguishes layout breakage from a map simply not being baked yet).
6. Comment coupling the plugin pin (v0.1.1-preview) and prebake pin (v0.1.0-preview) so future bumps consider both.

Found but deliberately NOT changed here (maintainer calls):

• Pre-existing bug: ${VALIDATE:+validate} in shared/scripts/update.sh treats VALIDATE=false (the ENV default) as truthy, so steamcmd always validates; fixing it changes update behavior platform-wide, flagging instead of patching.
• Dockerfile vs Dockerfile.dev duplicate CS2FOW blocks mirror the metamod/ccs convention; a shared install script would remove drift risk (the metamod URLs in those two files have already drifted upstream).
• cs2fow.cfg relies on the upstream plugin auto-exec'ing its own config (its documented behavior); on the e2e checklist to confirm, along with the AVX-only (vs AVX2) requirement on real hardware.

[Flegma]

Local verification addendum (closes the gaps flagged in the review comment):

• Native compile proof: dotnet build (SDK 10.0.301) on apps/counterstrikesharp: 0 warnings, 0 errors. apps/swiftly also builds clean against the shared MatchOptions change, and its test suite passes 80/80 including EntityContractTests. This also proves the earlier MSB4184 docker-build failure was qemu-emulation flakiness, not an SDK regression (same SDK version compiles natively).
• Prebake fetch end-to-end (real download): shared/scripts/update.sh with a stubbed steamcmd and the AVX gate bypassed fetched the actual 496 MB pack, SHA256 verified, installed 22 .bvh8 files into BASE_SERVER_DIR/.cs2fow/maps, wrote the version marker, exited 0; a rerun downloaded nothing (marker honored); with steamcmd stubbed to exit 7 the script propagated a nonzero exit through the prebake block as designed.

Remaining for the dev-stack e2e pass: live match scenarios (cs2fow_status, toggle, workshop auto-bake), the kill switch through a running api, the AVX-vs-AVX2 question on real hardware, and confirming the plugin auto-execs cfg/cs2fow.cfg.