refactor(battlenode): engine-first token identity (cardId); keep wire-mining fallback (M-HC-4f, partial)

Source the played card's opponent-facing knownList[].cardId off the shadow engine
(SessionBattleEngine.PlayedCardId -> BattleCardBase.CardId), engine-first with the
wire-mined idx->cardId map as the fallback. PROVEN engine-resolved (each backed by a
HeadlessConductorTests PlayedCardId_* test): deck cards and receive-path substituted/
revealed tokens (engine seats the wire id at the wire idx).

PARTIAL retirement: the wire-mining bookkeeping (MineAddOps/MineChoicePicks/MineCopyTokens
+ Record*From) is KEPT as the load-bearing fallback. The choice/Discover, copy/clone and
cross-side (isSelf:0) token cases are NOT proven to resolve at a wire idx headless — the
autonomous token_draw path seats a chosen token at engine Index 0 (would collide with the
leader), and copy/cross-side aren't cheaply fixturable. Deleting their mining on faith
would silently corrupt opponent reveals, so it stays behind a TODO(M-HC-4f) gate.

- SessionBattleEngine.PlayedCardId: new accessor mirroring PlayedCardClan/Tribe.
- BuildPlayedCard: signature deckMap->explicit cardId; null on cardId==0 (no engine id AND
  no mined/deck-map fallback).
- PlayActionsHandler: cardId = engine.PlayedCardId(seat, idx, fallback: mapped) ; mining retained.
- Tests: PlayedCardId_* (deck/substituted/degrade pass; choice-gap [Explicit] documents the
  Index-0 finding). KnownListBuilder + CaptureConformance call-sites updated to new signature.

Full BattleNode suite 263/263 green; HeadlessConductorTests 27/27; drift clean; no Engine edits.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

SVSim.BattleNode/Sessions/Engine/SessionBattleEngine.cs

@@ -279,6 +279,29 @@ internal sealed class SessionBattleEngine
         return card?.SpellChargeCount ?? fallback;
     }
 
+    /// <summary>The engine-RESOLVED card identity (wire <c>cardId</c>) of the card whose engine <c>Index</c> ==
+    /// <paramref name="idx"/> on <paramref name="playerSeat"/> (M-HC-4f), read straight off
+    /// <see cref="BattleCardBase.CardId"/> — the TRUE id the engine resolved during the conductor's
+    /// <c>ShadowIngest</c> (<c>engine.Receive</c> ran BEFORE this read). This is the authoritative identity for
+    /// EVERY card the engine seats, retiring the wire-mined idx→cardId bookkeeping for the played card:
+    /// <list type="bullet">
+    /// <item>a DECK card carries its dealt id (the seeded shuffled-deck identity);</item>
+    /// <item>a GENERATED token carries the wire id <c>CreateActualCard</c>/<c>ReplaceReceivedCards</c> stamped on it
+    ///   (M-HC-2 proved reveal seats the wire cardId);</item>
+    /// <item>a CHOICE/Discover token carries the CHOSEN id (M-HC-4c proved the chosen token lands with its true id);</item>
+    /// <item>a COPY/clone token carries the COPIED id (the engine copies the source card at baseIdx).</item>
+    /// </list>
+    /// Same post-resolution zone search + degrade-to-<paramref name="fallback"/> contract as
+    /// <see cref="PlayedCardCost"/>: no engine / no card → <paramref name="fallback"/>, so a non-engine session
+    /// (the single-active-engine gate left this session without an owned engine) keeps emitting the deck-map id via
+    /// the caller's fallback, never crashing.</summary>
+    public long PlayedCardId(bool playerSeat, int idx, long fallback = 0)
+    {
+        if (_mgr is null) return fallback;
+        var card = FindByIndex(Seat(playerSeat), idx);
+        return card is null ? fallback : card.CardId;
+    }
+
     /// <summary>The engine-RESOLVED clan of the card whose engine <c>Index</c> == <paramref name="idx"/> on
     /// <paramref name="playerSeat"/> (M-HC-4e), as the int <c>ClanType</c> ordinal prod sends on the
     /// knownList entry (e.g. <c>clan:8</c> in the tk2 capture). Reads <see cref="BattleCardBase.Clan"/>, whose
@@ -307,8 +330,9 @@ internal sealed class SessionBattleEngine
     /// prod no-tribe form — NEVER empty, which is wire-illegal: prod always sends tribe as a non-empty string,
     /// the client reads it via <c>item.Value.ToString()</c> at NetworkBattleReceiver.cs:2382). The degrade is
     /// LIVE, not dead: a second concurrent battle that loses the single-active-engine gate has <c>_mgr is null</c>
-    /// yet still emits a knownList entry (KnownListBuilder.BuildPlayedCard gates on the deck map, not engine
-    /// ownership), so this path must hand back a legal wire value.</para></summary>
+    /// yet still emits a knownList entry (the handler resolves the identity via the deck-map/mined fallback when
+    /// the engine read degrades, so BuildPlayedCard still synthesizes an entry), so this path must hand back a
+    /// legal wire value.</para></summary>
     public string PlayedCardTribe(bool playerSeat, int idx, string fallback = "0")
     {
         if (_mgr is null) return fallback;