Active wound attribution and counter cap

RE-708. Reproduce with python3 scripts/analyze_qvm_damage_attribution.py; check with python3 scripts/test_qvm_damage_attribution.py. The machine report retains source identity and bounded fixtures.

Actual290228–290297 runs after the active client/wound gates. It writes target836 to the attacker pointer, client4300 to the weapon, and ORs256 into client220. Only signed client4304 below4 resets client4316 to zero and increments the counter. Existing counters4 and higher are preserved; negative fixtures expose signed arithmetic without establishing legal gameplay state. Other tracked client fields remain unchanged. This range does not allocate events, call external functions or apply health damage.

No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.