Decomp advanced 18 commits to 8a174cb; 14 new matched functions land in our .text

Checked upstream as asked. The vendored checkout moved from aca4f59 to 8a174cb,
18 commits ahead of origin/master.

What the update is: all 18 commits are src/game function-matching work. No header,
no docs, no config, and crucially no change to config/levels/functions.tsv -- so
the function extents and level catalogue this project depends on are unaffected.

What is usable: 14 of the newly matched functions fall inside the overlay .text
(0x2a3b80-0x447900), which makes them decomp addresses verified against the same
code this project runs:

    002A7750 002AA800 002B3868 002B6120 002B7E28 002C7748 002CD8C0
    002D5E98 002DDEC8 002DF1B8 002E7018 002F5220 002FC8D0 00300618

That matters because PROVENANCE.md records exactly this split: the decomp's struct
layouts were usable while its function addresses were not (they failed for the moby
class loader). Addresses that are now matched inside our own overlay are the
reliable kind, and 20655c7 needs precisely that to follow UpdateCamera_6 out of
lvl.camvtbl without repeating the mistake that cost the moby_anim chase.

What it does not give: none of the 14 is camera, frustum or GS code. The bodies are
game logic and toolchain-status material -- one is a header-offset relocation pass,
another raises a flag and forces a state word out of {6,7}. So the frustum hunt
does not advance from this, and the next step remains verifying UpdateCamera_6's
address against the overlay and reading the function that writes 0x18aa70.

Vendored checkout is gitignored, so moving it changes nothing committed except the
PROVENANCE note recording the pin and what was in the update.

PROVENANCE.md

@@ -119,3 +119,22 @@ Rust dependencies keep their own licences; see `Cargo.lock` and each crate's
 1. Record it in this file, with its licence and what you took.
 2. Keep the upstream notice intact in any file containing derived code.
 3. If it would change this project's licensing terms, stop and say so first.
+
+## Update 2026-10-15: decomp advanced to 8a174cb
+
+Vendored checkout moved from `aca4f59` to **`8a174cb`**, 18 commits ahead
+(`origin/master`). All 18 are `src/game` function-matching work; **no header,
+doc, config or `config/levels/functions.tsv` changes**, so the function extents and
+level catalogue this project uses are unaffected.
+
+What is new and usable: **14 of the newly matched functions fall inside the
+overlay `.text`** (`0x2a3b80`-`0x447900`), so they are decomp addresses verified
+against the same code this project runs:
+
+    002A7750 002AA800 002B3868 002B6120 002B7E28 002C7748 002CD8C0
+    002D5E98 002DDEC8 002DF1B8 002E7018 002F5220 002FC8D0 00300618
+
+None of them is camera, frustum or GS code -- the bodies are game logic and
+toolchain-status material. Recorded because matched-in-overlay addresses are the
+thing `PROVENANCE.md` says is reliable here, and `20655c7` needs exactly that kind
+of anchor to follow `UpdateCamera_6` from `lvl.camvtbl`.