feat(render3d): gate R3D_* switches behind R3D_DEV in windowed builds

Every R3D_* read goes through r3d_env_has / r3d_env (env.ludic): a headless
build honours them as before, a windowed build only when R3D_DEV is set to
anything but "0", so a shipped game never reaches a debug view, feature kill,
file writer or hardware fake. Documented in docs/SHIPPING.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/ludic.render3d/env.ludic

@@ -0,0 +1,19 @@
+# env.ludic — the one gate every R3D_* switch goes through.
+# The debug views, feature kills, file writers and hardware fakes are developer
+# tools: a headless build (tests, benchmarks, frame dumps) always honours them, a
+# windowed build - which is what a player runs - only when R3D_DEV is set to
+# anything but "0". Read every R3D_* through r3d_env_has / r3d_env, never
+# Os.has_env / Os.env.
+var r3d_dev_v: int = -1
+function r3d_dev() -> bool {
+  if r3d_dev_v < 0 { if Os.has_env("R3D_DEV") and Os.env("R3D_DEV") != "0" { r3d_dev_v = 1 } else { r3d_dev_v = 0 } }
+  return r3d_dev_v == 1
+}
+function r3d_env_has(name: string) -> bool {
+  if is_windowed() and not r3d_dev() { return false }
+  return Os.has_env(name)
+}
+function r3d_env(name: string) -> string {
+  if is_windowed() and not r3d_dev() { return "" }
+  return Os.env(name)
+}