Ship S2 fixes: structural anchors are not mounts, mod presets refused, one bad mod never bricks the boot

- Validate: a hardpoint's anchor role is fixed by its type (thruster-emitter, radiator-mesh, else articulation); ShipModPlan's
  duplicate role check is deleted.
- Loadouts.Commit refuses a preset naming a mod design (mod-hull:/mod-ship:), so the shipped catalog never references a mod.
- Compose quarantines each package: a bad package is excluded and named, a collision excludes every package involved; the
  game boots on the rest (or the shipped catalog) and the main menu lists the exclusions.
- RequireDesigns refuses a save with a null item or lot instead of throwing NullReferenceException.
- Tests: per structural role, muzzle id ties, every slot/zone/lot in RequireDesigns, listing order, exclusion cases.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assets/Scripts/UI/MainMenu.cs

@@ -89,6 +89,8 @@ public class MainMenu : MonoBehaviour
         _fadeFromRight = fromRight;
     }
 
+    private static bool _exclusionsShown;
+
     private void ShowMain()
     {
         _nextMenu.panel.Clear();
@@ -97,6 +99,11 @@ public class MainMenu : MonoBehaviour
         {
             // A run exists only as the run store's SavedGame global.
             var cache = ActionGameManager.CultCache;
+            if (ActionGameManager.ModExclusions.Length > 0 && !_exclusionsShown)
+            {
+                _exclusionsShown = true;
+                Refuse("Some mods were not loaded", string.Join("\n", ActionGameManager.ModExclusions.Select(exclusion => exclusion.ToString())));
+            }
             var saved = cache.GetGlobal<SavedGame>();
             if (saved == null && cache.AllStoredDocuments.Any(stored => RunSave.IsRunRecord(stored.Descriptor.DocumentType)))
                 Debug.Log("run store has no SavedGame; Continue disabled");