fix(game3): save, item, map, script and importer bugs found in review

The rest of the Gen 3 review fixes, each with a gated suite in tests/engine/.
ROM semantics were checked against pret/pokefirered.

Scripts
- givemon carried the wrong operand layout, found earlier; four more layout
  desyncs came out of pret asm/macros/event.inc: comparestat is {byte,word},
  and setptr / loadbytefromptr / setptrbyte each carry a leading byte plus a
  word. A wrong size mis-decodes every instruction after the bad one, so
  Versions.CACHE_VERSION moves to 113 and existing caches re-import.
- handlers for previously handler-less verbs: comparestat,
  bufferitemnameplural, setmonmove, setmonmetlocation, the modern
  fateful-encounter pair, the script-locals family (copylocal, setptr,
  loadbytefromptr, setptrbyte, copybyte, compare_local_to_* and
  compare_ptr_to_*), the RAM-script family (setvaddress, vgoto, vcall,
  vgoto_if, vcall_if, vmessage, vbuffermessage, vbufferstring, endram,
  returnram) and the same-map forms of the *at verbs.
- setdooropen / setdoorclosed read their coordinates through VarGet.

Battles
- Knock Off and Thief / Trick persist the item change instead of only
  touching the in-battle copy.
- knocked-off party slots are tracked in a bitmask, so a slot reused later
  does not inherit the flag.

Field and UI
- Player.reset restores facing and clears the surf flags.
- a definition-less Map.load no longer leaves collision unbound.
- an unresolved region-map section no longer reports PALLET TOWN.
- the naming screen splits input from the timer, so update(dt) stops
  indexing a number.
- the hall of fame commits through the engine save path and serializes its
  fields.

Persistence
- gameStats, the link-battle records and the trainer card are serialized.
- the PC deposit refuses at the 999 cap instead of destroying the overflow.

Robustness
- Data.load runs cached modules sandboxed.
- the file browser quotes shell arguments.
- .meta dimensions are bounds-checked and mids.idx validates its header.

src/core/Data.lua

@@ -264,7 +264,11 @@ local function loadModule(dir, name)
   local path = "data/generated/" .. name .. ".lua"
   local bytes = CacheFs.readActive(path)
   if type(bytes) == "string" then
-    local chunk = loadstring(bytes, "@" .. GameVersion.cachePrefix() .. path)
+    -- Sandbox the generated module the way every other cache loader in the
+    -- engine does (dataset/doors/field/...).  Without an environment the chunk
+    -- ran with the real os/io/loadfile in scope, so a file dropped into the
+    -- user-writable cache would execute at boot.
+    local chunk = load(bytes, "@" .. GameVersion.cachePrefix() .. path, "t", {})
     if chunk then
       local ok, res = pcall(chunk)
       if ok then return true, res end
@@ -275,6 +279,10 @@ local function loadModule(dir, name)
   return false, nil
 end
 
+-- Test seam: the generated-module loader, so a suite can pin the sandbox that
+-- keeps cache files from reaching os/io/loadfile at boot.
+Data._loadModule = loadModule
+
 function Data:load()
   local dir = os.getenv("POKEPORT_DATA_DIR")
   local gen = require("src.core.GameVersion").generation()