feat(render3d): gate R3D_* switches behind R3D_DEV in windowed builds

Every R3D_* read goes through r3d_env_has / r3d_env (env.ludic): a headless
build honours them as before, a windowed build only when R3D_DEV is set to
anything but "0", so a shipped game never reaches a debug view, feature kill,
file writer or hardware fake. Documented in docs/SHIPPING.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/ludic.render3d/overlay.ludic

@@ -98,7 +98,7 @@ function overlay_init(font_dir: string) -> bool {
   ov_white = tex_solid(255, 255, 255, 255)
   overlay_font(font_dir)
   if ov_font == 0 { print("overlay: no font atlas, text disabled") }
-  ov_dbg = Os.has_env("R3D_FONTDBG")
+  ov_dbg = r3d_env_has("R3D_FONTDBG")
   ov_ready = true
   return true
 }