Replace legacy game assets with M2 set and restore demo enemies

[ralyodio]

The previous art pass still used legacy base meshes, and the public demo could look empty or stop producing useful combat. This replaces the complete runtime model inventory and fixes the reproduced demo defects.

• Cover all 31 former model entries with 28 M2 GLBs: both operators, cargo, tanks, pipes, catwalks, walls, bunker, stairs, lighting, vehicles, props, weapon family and skyline structures. Consolidate redundant entries. Keep the approved original C7 rifle, field case and low cover; remove every legacy licensed mesh, rig and clip from the active pipeline and runtime.
• Add original operator rigs and locomotion/death clips, generated fabric/coating surfaces, consistent material bindings and new model/texture URLs. Remove obsolete runtime files, version the content cache and retire the legacy cache on normal worker activation.
• Make ?mode=demo explicitly select combat even after saved Free Roam. Fix below-ground skinned character bounds, faction assignment, stacked initial spawns, rifle death/respawn timing, bot vertical aim, firing into cover and navigation around obstacles. Pause simulation behind the menu and keep the local sandbox running past competitive match limits.
• Add reproducible Blender generation, per-model previews, provenance, full replacement mapping and regression checks. Content revision is 1.2.0; wire protocol and collision volumes are unchanged.

Validation:

• 277 tests across 21 files pass, including loaded operator bounds throughout animation, actual factions/spawn pads, damage/respawn, sustained fire, navigation clearance and retired asset rejection.
• All 28 GLBs: zero Khronos errors and zero warnings.
• Game TypeScript and production build pass. Repository ESLint and Prettier passed after the browser harness cleanup.
• Models, textures and effect audio total 9,342,093 bytes (8.91 MiB), within the unchanged 9 MiB limit.
• Browser smoke loaded all 28 modern models, rendered the enemy above ground, fired through game input/hitscan handlers to zero health, and verified pause. Headless pointer-lock/DOM input adapter used; native pointer lock and hardware GPU performance are not claimed as validated.

Review all 28 actual model renders, the in-engine combat frame, and root causes/inventory.

Remaining: the ten-image marketing gallery still contains the previous release's captures. The execution environment disconnected during its refresh; the updated capture script is committed, but those new gallery files are not included. The complete game runtime asset replacement is included. This is original procedural tactical art, not a claim of AAA photogrammetry fidelity.

Deploy client and multiplayer services together on content revision 1.2.0. This PR has not been merged or deployed.

[github-actions]

ThreatCrush Security Scan

9 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 5

Severity	Rule	Location
HIGH	manifest-typosquat	apps/game/package.json:17
HIGH	sh-remote-script-execution	apps/site/public/install.sh:210
HIGH	sh-remote-script-execution	apps/site/public/install.sh:213
HIGH	sh-remote-script-execution	apps/site/public/install.sh:216
MEDIUM	sh-remote-script-execution	apps/site/public/install.sh:219
MEDIUM	sh-remote-script-execution	apps/site/public/install.sh:432
MEDIUM	sh-remote-script-execution	apps/site/public/install.sh:433
MEDIUM	js-path-traversal	tools/art/tactical-sample/validate.mjs:6
MEDIUM	js-path-traversal	tools/art/tactical-sample/validate.mjs:10

Snippets are redacted; ThreatCrush never prints matched credential material.