Capture presets through their own cache; keep the catalog read-only

Opening the process cache's catalog writable in the editor was the wrong cut.
It made catalog read-only only by convention, so a stray catalog write in play
succeeded and a later flush could land play-mutated instances in Aetheria.cc.

- The process cache opens the catalog read-only in every build again, so the
  missing-global check runs for it as it did before db83cd29. The writable
  empty-seed exemption from ab4ced0f stays for AetherDb and fixtures.
- Loadouts.Commit(catalogPath, loadout, replace) is the only preset writer. It
  opens its own short-lived cache over the catalog, writable, commits the one
  preset conditionally on its key and disposes it. No other cache or instance
  is touched. The running game sees the preset only after the catalog reloads.
  CultLib at a0813c6 allows this: a read-only single-file store takes no lock
  and holds no handle, and the writer's commit takes the exclusive sidecar
  <path>.lock and replaces the file atomically.
- Capture refuses, writing nothing, when Aetheria.cc is missing (it never
  creates the catalog), when a preset of that name exists under another key
  (CultCache does not reject duplicate names on write), or when the key holds a
  preset and replace is not given.
- The console refuses a command with any character outside letters, digits,
  spaces and hyphens instead of stripping it, so "Mk.II" can no longer become
  "MkII". capturepreset refuses a second argument other than replace, so an
  unquoted capturepreset My Ship refuses instead of saving "My".
- The capture log line says the session sees the preset after a reload, and
  that a Studio session opened earlier overwrites captured presets on save.
- Tests: capture while the process cache holds the catalog read-only leaves it
  unchanged; a missing catalog refuses and creates nothing; a same name under a
  Studio-minted key refuses, with or without replace; a game-shaped read-only
  open missing a global throws. The existing preset tests now commit through
  the catalog path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assets/Scripts/UI/ConsoleController.cs

@@ -76,6 +76,10 @@ public class ConsoleController
 		
 		string[] commandSplit = ParseArguments(commandString);
 		string[] args = {"",""};
+		if (commandSplit == null) {
+			AppendLogLine("Refused: commands take only letters, digits, spaces and hyphens");
+			return;
+		}
 		if (commandSplit.Length < 1) {
 			AppendLogLine($"Unable to process command '{commandString}'");
 			return;
@@ -115,10 +119,7 @@ public class ConsoleController
 		var parmCharsArr = new char[parmChars.Count];
 		parmChars.CopyTo(parmCharsArr, 0);
 		var args = new string(parmCharsArr).Split(new[] {'\n'}, StringSplitOptions.RemoveEmptyEntries);
-		for (var i = 0; i < args.Length; i++)
-		{
-			args[i] = _permittedCharacters.Replace(args[i], "");
-		}
-		return args;
+		// An argument with any other character is refused (null), never silently stripped into a different one.
+		return args.Any(arg => _permittedCharacters.IsMatch(arg)) ? null : args;
 	}
 }