fix(tools): importers clear the read-only LFS bit before saving; docs refresh

0.1.3 packaging and setup fixes from what 0.1.x actually exposed.

- New Tools/ue_common.py: make_writable() clears the read-only bit an LFS .umap
  checks out with (save_map() otherwise returns False silently and the staged actor
  is lost) and require_saved() makes that failure visible. ue_hero_facade_import and
  ue_import_north_buildings now call it; the map builders already did. Verified from
  a forced 0o444 map: chmod logged, save_map True, exit 0.
- Docs/build.md: pipeline table now lists the seven site FBXs plus frontage, north,
  hero and map steps and the shared FBX preset; packaging archive corrected to
  Builds/GigLineQA; packaged-log location and -qaselftest usage documented; new
  'Traps that cost real time in 0.1.x' table (read-only save, hero --out is the FBX,
  MPFB add-on path, shot actor quitting under QA, null-RHI trace trap).
- Docs/setup.md: fresh-checkout build marked verified 2026-11-08 and the blocker
  closed; new optional-keys section for OPENROUTER_API_KEY and MAPBOX_ACCESS_TOKEN
  (gitignored .env, not needed by build/tests/release).
- Docs/Architecture 07 + architecture.md: build-output path corrected, marked
  outside the repository.
- 5 new tests for ue_common (54 total).

Docs/setup.md

@@ -83,13 +83,24 @@ Without `git lfs install`, adding an LFS-matched file does not error — it comm
 
 Sizes: the engine lives outside the repository (pinned install path recorded in `toolchain.md`). The repository holds the Unreal project, Blender sources, geo sources, and tooling.
 
-**Fresh checkout not yet tested end to end.** The build procedure in [build.md](build.md) was produced from a working tree, not from a clean clone. Exercise it before `v0.1.0` is tagged — it is a release check on the board.
+**Fresh checkout verified 2026-11-08.** A clean clone of `main` with `git lfs pull` built both `GigLineEditor` and `GigLine` against the documented external engine (recorded in [release-checks.md](release-checks.md)). Re-run it before a release tag if the engine pin or the module's dependencies change.
+
+### Optional keys (local only)
+
+Two tools talk to paid services and read their keys from the gitignored `.env`:
+
+| Variable | Used by | Needed for |
+| --- | --- | --- |
+| `OPENROUTER_API_KEY` | `Tools/judge_screenshot.py`, `Tools/facade_detail_concepts.py` | vision pre-check and AI concept plates |
+| `MAPBOX_ACCESS_TOKEN` | `Geo/tools/mapbox_buildings.py` | the second building-height source |
+
+Nothing in the build, the tests or the release path needs either key. Never commit `.env`; `git check-ignore .env` should succeed.
 
 ## Known blockers
 
 | Blocker | Owner | Needed for |
 | --- | --- | --- |
 | Delete the fallback 5.2.0 engine archive (`/run/media/system/DATA/Downloads/Linux_Unreal_Engine_5.2.0.zip`) once the 5.8.4 pin is trusted through asset production | agent | Disk hygiene (19.6 GiB), pin safety |
-| Fresh-checkout build exercised against the documented procedure | agent | `v0.1.0` release check |
+| ~~Fresh-checkout build exercised against the documented procedure~~ | — | Done 2026-11-08 |
 
 Closed 2026-11-07: Epic account and engine download, QGIS `lts` removal, Blosm and MPFB on Blender 5.2 (headless invocation fix in `Art/blender/README.md`), engine validation on Bazzite, full project bootstrap. Earlier closed: Bazzite update and reboot, driver and Vulkan verification, `git-lfs`/`clang`/`cmake`/`ninja` layering.