v0.5.0 playtest fold-in: fog and near-plane clip, crash fixes, polish (D540-D564)

Deck/Windows playtest fixes: fog rework (D540) and RSP-style CPU near-plane
clip with per-vertex N64 fog (D543), with fog recomputed on near-plane-clipped vertices as the RSP does,
so the haze around the player stays steady (D553); colour-combiner clamp for banded walls
(D548); rocket and thrown-item stack overflows (D545, D549); menu
double-trigger mitigation (D541); Dam ending first-shot camera swivel
restored by removing an old port look-at workaround (D552); settings standardisation (D546), live
All unlocked (D547), F10 mouse (D544); static window title and the project
mark (the in-game crosshair shape, site gold) as window/taskbar icon and
favicon (D550). Reference frames re-based
on Windows, Linux and Steam Deck (A/B-confirmed); capture_p7.sh runs on
Windows. Opt-in update check, off by default (D551: one HTTPS request to
GitHub per launch when enabled; winhttp.dll loaded only then; the tag CI
job checks the tag against GE007_VERSION). Release notes, ROADMAP,
internals and security docs updated; tree-hygiene pass.

Refs: D540 D541 D543 D544 D545 D546 D547 D548 D549 D550 D551 D552 D553 D554 D555 D556 D557 D558 D559 D560 D561 D562 D563 D564

docs/security.md

@@ -1,6 +1,6 @@
 ---
 title: Security status
-description: What a GoldenEye PC port release installs and doesn't: no networking, no telemetry, no ROM, no system writes — re-verified against the v0.5.0 source.
+description: What a GoldenEye PC port release installs and doesn't: no networking unless you opt in to the update check, no telemetry, no ROM, no system writes — re-verified against the v0.5.0 source.
 date: '2026-10-05'
 modified_time: '2026-10-05'
 ---
@@ -20,7 +20,9 @@ bundle contents were not re-checked then.
 **v0.5.0 update pass, 2026-10-05:** the source checks were re-run against
 the current tree — no socket/network includes, no network symbols and no
 HTTP string literals in the compiled `src/` and `port/` sets; no registry
-or library-loading calls in either; the converter's Python sources
+or library-loading calls in either (since D551 the one exception is the
+opt-in update check: a System32 `winhttp.dll` load on Windows or a `curl`
+process on Linux, only when `Game.CheckUpdates` is on); the converter's Python sources
 (`prepare-assets.py` and its emit-script imports) import no network
 module. The bundle contents were re-checked against the packaging
 manifests (`tools_pc/bundle-win.sh` / `bundle-linux.sh` — the scripts CI
@@ -44,8 +46,15 @@ legally-owned copy.
 
 At runtime, the engine:
 
-- has **no networking of any kind** (no sockets, no HTTP, checked directly
-  against the source),
+- has **no networking unless you turn on the opt-in update check**
+  (`Game.CheckUpdates`, off by default): then it makes one HTTPS request to
+  GitHub's releases API per launch (a fixed User-Agent; GitHub sees the
+  request and your IP, as with any web request) and never downloads or
+  installs anything. On Windows it loads the system `winhttp.dll` from
+  System32 at runtime only in that case (it is not in the import table); on
+  Linux/Steam Deck it runs the system `curl`. With the setting off there
+  are no sockets and no HTTP (D551; checked against the source and run live
+  on Windows, Linux and Steam Deck),
 - has **no telemetry, crash reporting, or analytics** of any kind,
 - **never touches the Windows registry** and **never requests elevated
   permissions**,