D254/D255: stop the Linux crash handler eating its own logs; document the Facility firefight crash

The POSIX handler re-entered on SIGABRT (sysFatalError -> abort) and
truncated ge007.crash.log, so field crashes came back as bare abort
records with no faulting PC or registers. Guard against re-entry,
terminate directly with _exit(), and dump si_addr + the general register
set from the ucontext — a Deck crash now names the bad pointer on its
face.

Also documents D255 (new SIGSEGV in vtxstore's active-object walk during
a Facility firefight on the Deck; disassembly shows the fault is a
32-bit-zero-extended read of ObjectRecord.model, misnamed ChrRecord.
chrflags by the decompiler) and updates the release notes' Deck status.

.github/release-notes.md

@@ -51,9 +51,12 @@
   selected** (e.g. the MSAA value appears both on its own row and again at
   the panel bottom); earlier builds showed it as an intermittent 4K-
   fullscreen ghost of the top row.
-- **Not yet verified on real Steam Deck hardware** — the bundle is built for
-  it and its prime crash suspect from v0.1.0 was fixed, but please report any
-  Deck-specific faults (a `ge007.crash.log` next to the exe helps).
+- **Steam Deck: one open crash remains** — the v0.1.0-era Facility crash is
+  confirmed fixed on Deck hardware, but a *new* SIGSEGV can occur during a
+  firefight in Facility (D255); diagnosis is in progress. Other levels are
+  untested there so far — please report any Deck-specific faults (a
+  `ge007.crash.log` next to the exe helps; recent builds now capture full
+  faulting registers in it).
 
 ### Downloads