port: land the play-tested work, and only that

Takes the port branch up to 77320d5e -- the state the human play-tested on
2026-09-02 -- for SOURCE paths only. Not a branch merge: `auto/port-p6-audio`
is 366 commits and 938 files, and most of that must not land.

WHAT COMES IN (76 files, all human-confirmed working):
  * the logo splash animation. 08ed3dd1 found it: `pose_at` ASSIGNED the settle
    instant instead of clamping to it, so the splash never animated at all --
    and the same bug manufactured a passing harness result, because the harness
    photographed t past the settle. Confirmed by play-test: "cannot notice any
    obvious difference from the actual game."
  * gamepad input -- (A)/(B) bound additively (`ui_accept` ships with NO joypad
    binding), stick latched with hysteresis at the game's own 61% digitise
    threshold. This is what made (A), video-skip and Extras work at all.
  * menu navigation and flow, menu audio, the exporter, the authored
    declarations, and 23 verification tools under tools/port/.

WHAT IS DELIBERATELY LEFT ON THE BRANCH:
  * everything after c0ae460a -- the F5/F6 title-timing investigation, whose own
    tip commit calls itself a "hand-off for one-minute human checks". Unchecked
    by definition; it goes through the new review gate like anything else.
  * the OPTIONS menu work of 2026-09-03. Real, probably good, NOT play-tested.
  * the F1 repeat mechanism, which its own commit calls "deliberately inert".

WHAT MUST NOT LAND, AND WHY THE .gitignore CHANGED:
  545 MB of extracted game content was committed on that branch -- 850 sprite,
  audio and transcoded video files under `export-probe/` and `export-probe2/`,
  plus 246 MB of loose .wav and .tsv at the repo root. This repository's own
  rule, in this file, is "never game content".

  The rule was not missing. It was written, and it was tightened on that very
  branch, with a careful comment explaining why BOTH `export/` and `data/base/`
  had to be listed -- while the exporter was writing to a third name that
  nobody had thought to list. Enumerating names is the thing that failed. So
  the ignore rules now describe the SHAPE: any top-level `export*/`, game media
  by extension, and loose capture output at the root. Verified both ways -- it
  catches all four offenders and ignores nothing currently tracked.

Verified: `cargo check --workspace` clean; all nine GDScript files parse in
project context, with a positive control (an injected syntax error is detected,
3 lines) so the clean result means something. `tools/port/check-all` was NOT
run -- it needs the container, the export tree and a display.

tools/motion-census

@@ -46,8 +46,69 @@ from pathlib import Path
 
 try:
     from PIL import Image
+    _BACKEND = "pillow"
 except ImportError:
-    sys.exit("motion-census: needs Pillow (pip install pillow)")
+    # 🔴 FALLBACK, NOT A SECOND IMPLEMENTATION. The port's container has no
+    # Pillow and no pip, so the tool could not run at all there -- and a tool the
+    # port cannot run is a check the port does not have, which is how this class
+    # of defect survived in the first place.
+    #
+    # This shims only the three Pillow calls used below (open+convert, crop,
+    # resize+getdata, and new+save for the selftest) onto ImageMagick. The census
+    # arithmetic, the MOVED floor and the GRID are untouched, so the numbers are
+    # the tool's and not a re-derivation.
+    #
+    # `-grayscale Rec601Luma` rather than `-colorspace Gray`: Rec601 is what
+    # Pillow's `.convert("L")` uses, and IM7's `-colorspace Gray` linearises
+    # first, which would shift every value. Verified to round-trip a flat
+    # rgb(100,100,100) to exactly 100 on this build.
+    #
+    # ⚠️ The --selftest is what makes this safe to trust: it drives the SAME
+    # fade / switch / frozen discrimination through whichever backend is active,
+    # so a shim that distorted the pixels would fail its own control.
+    import subprocess
+
+    _BACKEND = "imagemagick"
+
+    class _IMImage:
+        def __init__(self, path=None, size=None, value=None):
+            self._path, self._size, self._value = path, size, value
+            self._crop = None
+
+        def convert(self, _mode):
+            return self
+
+        def crop(self, box):
+            x0, y0, x1, y1 = box
+            self._crop = (x1 - x0, y1 - y0, x0, y0)
+            return self
+
+        def resize(self, grid):
+            self._grid = grid
+            return self
+
+        def getdata(self):
+            cmd = ["convert", self._path]
+            if self._crop:
+                cmd += ["-crop", "%dx%d+%d+%d" % self._crop, "+repage"]
+            cmd += ["-grayscale", "Rec601Luma",
+                    "-resize", "%dx%d!" % self._grid, "-depth", "8", "gray:-"]
+            out = subprocess.run(cmd, capture_output=True).stdout
+            return list(out)
+
+        def save(self, path):
+            subprocess.run(["convert", "-size", "%dx%d" % self._size,
+                            "xc:rgb(%d,%d,%d)" % ((self._value,) * 3),
+                            "-grayscale", "Rec601Luma", str(path)], check=True)
+
+    class Image:  # noqa: F811 - deliberate stand-in, same call surface
+        @staticmethod
+        def open(path):
+            return _IMImage(path=str(path))
+
+        @staticmethod
+        def new(_mode, size, value):
+            return _IMImage(size=size, value=int(value))
 
 # Below this, two frames are the same picture. Chosen as a floor, not tuned: PNG
 # frames of an unchanged scene differ by exactly 0.000, so anything above noise