Pre-publication review: licensing, runtime hardening, CI, docs

[Naruto]

Pre-publication review sweep before this repository is made public: licensing/redistribution compliance, untrusted-input hardening, CI least-privilege/pinning, and documentation/comment cleanups. Split into four focused commits.

Changes

fix(runtime): validate untrusted .ssab/.ssqb before use

• SSABResource::is_valid() rejects an animation whose parts_animation_data is longer than the shared parts table. The Rust runtime indexes parts() positionally over it and, parsing unchecked under panic = abort, aborts the whole editor/game process at resource-create time on an out-of-range index. Only > is rejected, so no loadable file is refused.
• SSQBResource::load_from_file() runs the FlatBuffers Verifier and rejects a structurally-invalid buffer before any accessor follows its offsets.
• Drops the unregistered ssab_file_changed/ssqb_file_changed emits (never ADD_SIGNAL'd, no consumer; reload is driven by the built-in changed signal).

perf(render): reuse surface Array, cache SNAME; drop TestStub scaffolding

• _emit_partcolor_mesh reuses a member scratch Array (and empty blend-shape/LOD args) instead of allocating a fresh Array per call, clearing the slots afterwards so they never pin the caller's copy-on-write buffers — removing a per-part/per-frame heap allocation from the draw hot path.
• GDExtension SNAME caches the interned StringName per call-site (the per-frame frame_updated emit no longer re-interns the literal).
• get_world_matrix tightens its bound to p_idx*16 + 16 <= len to match the sibling accessors.
• Removes the TestStub embedded shader, teststub.fs, and the never-set _test_shader_id_hash_override debug field/branch.

build(ci): bundle third-party licenses, least-privilege perms, pin actions

• release.yml stages the runtime third-party license files into the artifact and bundles them plus THIRD_PARTY_NOTICES.md and licenses/Apache-2.0.txt into the release zip under addons/spritestudio/licenses/, so the statically-linked FlatBuffers / godot-cpp / Rust-crate licenses travel with the binaries.
• Declares least-privilege permissions: on release/pr/weekly and pins third-party actions to full commit SHAs.
• THIRD_PARTY_NOTICES.md adds godot-cpp (MIT) and references the bundled Apache-2.0 text.

docs: English-ize shipped comments, fix links/prereqs, document pause

• English-izes non-English comments in shipped scripts/code and rewords development-narrative comments.
• CONTRIBUTING adds Rust/zsh/godot-cpp prerequisites and a build.md pointer, and fixes the Japanese table-of-contents anchors.
• CHANGELOG uses Unreleased instead of a placeholder date; docs index sample links are made absolute so they resolve on the docs site.
• The SpriteStudioPlayer2D doc class documents that pause() toggles and is_playing() stays true while paused (use is_pausing()).

Verification

• Builds green (macOS editor GDExtension) at each step.
• A standalone harness (FlatBuffers + ssab.h) confirms is_valid() accepts all real .ssab samples, rejects a mutated structurally-valid-but-semantically-inconsistent buffer (the crash case), and rejects corrupt/truncated buffers.
• Diff reviewed from multiple angles (C++ regression + CI/docs/license); no blockers found.

Not included / deferred

• SDK-side items (private SpriteStudio-SDK submodule): fork-PR CI and build-runtime/download-sdk depend on the SDK repo & its Releases becoming public; and the complete .ssab crash-safety backstop needs an SDK-side fix (catch_unwind does not work under panic = abort — the runtime must switch to unwind or add Rust-side bounds checks). Tracked separately.
• Repo self-links are kept on cri-middleware; the org/URL choice is a separate (non-code) decision and can be dropped from this PR if preferred.