Resolve the shrub region bound: the chunk container closes it

The shrub region's end was the last unlocated bound in core_data. It was not
in the core index, and unlike moby->tie it had no successor boundary to chain
against, so the last shrub class in every level ran out to the lump's end and
the aggregates over it (the "3.5M records / 28MB of shrub body") were
artifacts of that oversized span.

Range measured: for each level, from the last shrub class's geometry offset to
the constant trailer. Nothing outside that range is read.

Method: scan forward from the last shrub class for the pair (a) the constant
two bytes f6 7c sitting immediately in front of (b) a chunk signature -- a
16-byte header ending 0xff, ten zero bytes, then four or more 0xf0-tagged
offsets. The two halves are each weak alone, and the halves are measured
separately: the marker pair occurs 25 to 103 times in a 5 to 17 MB lump, so
matching it alone picks dozens of wrong offsets; the chunk shape matches
random data often enough to need four tagged offsets before it is believed.

Result: on all 27 levels the marker sits exactly two bytes before the first
chunk header, and the two parts of the signature are never found apart. No
chunk signature occurs inside any last shrub body, on any level. The three
levels without shrub (10, 25, 26) carry the same marker before the container
that closes tie instead, which is what makes the locator a property of the
region rather than a shrub rule.

Consequences:

- All 358 shrub class bodies are bounded and are whole 8-byte records. That
  was not assertable while the last class in each level ran to the lump's end,
  and it is the check the boundary earns its keep for.
- 9,600 records in total, against the 8,938 previously measurable in
  successor-bounded spans; 662 of them sit in the 24 last-class bodies. The
  shrub region totals 2,033,776 bytes across the 24 levels that have one.
- The chunk container is 25,775,850 bytes across 27 levels (1,236 chunks,
  22,562 records). The container measurements were previously taken over "the
  900,000 bytes before the trailer", a window that did not align to its real
  extent: on level 0 it is 690,302 bytes, and 27 of 1,123 chunks were
  truncated at that invented edge. chunk_containers_resolve_on_every_level now
  reads the region from core_layout instead of measuring backwards from the
  end of the lump.

core_layout takes core_data now: the container's start is the one bound that
cannot be derived from the index. It gains the chunks region, so every byte of
level-specific core_data belongs to a named region. Where the signature is not
found the end stays None -- the region is left visible rather than clamped to
the tail.

Still open: the marker's meaning (constant across 27 levels, at exactly this
position, unnamed) and the shrub body payload's encoding.

docs/roadmap.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-Status as of **2026-10-09**.
+Status as of **2026-10-11**.
 
 A from-scratch native Rust reimplementation of Ratchet & Clank: Going Commando
 (PS2). Each phase ends in a **gate** — something checkable, not a feeling that
@@ -57,6 +57,14 @@ early, while they are still cheap to retire.
       through `LightTfrags`. The renderer still counts and reports how many
       vertices it lit, because a silent fallback to stored colours would look
       plausible and be wrong.
+- [x] **The shrub region is bounded, and with it the whole lump.** Shrub's end
+      was the last unlocated region bound: it is the start of the post-class
+      chunk container, found by a marker-paired signature in `core_data` (the
+      index carries no successor offset). The container closes shrub on the
+      24 shrub levels and tie on the three without. All 358 shrub class bodies
+      are now bounded and are whole 8-byte records, so shrub measurements are
+      trustworthy for the first time -- the "3.5M records" figure from the
+      unbounded final span is replaced by a measured 9,600.
 - [ ] Lighting *magnitudes* are unverified: they need comparison against
       reference frames, which needs the PCSX2 comparison loop.
 - [ ] Then the GS register set and the guard-band clip test.
@@ -153,6 +161,9 @@ Phase 1 hands over the extents; this phase works out what each one contains.
 - [x] Region layout of `core_data` established: tfrag, occlusion, sky, collision
       and `textures_base` are offsets, strictly increasing on all 27 levels.
       Terrain is `[0, occlusion)` and carries inline texels.
+- [x] Region layout **closed**: the chunk container's marker-paired signature
+      ends the last class region, and the constant trailer ends the container.
+      Every byte of level-specific `core_data` now belongs to a named region.
 - [x] **tfrag vertex format: recovered.** The tfrags block header gives a table
       offset (`0x40`) and a patch count; each patch is a 0x40-byte header whose
       `data` offset is relative to the table, not to the block. Positions are
@@ -209,8 +220,10 @@ Phase 1 hands over the extents; this phase works out what each one contains.
       Geometry header parsed and both fields **checked**, not merely reported:
       `+0x24` equals the entry's own `o_class`, and `+0x2c` is an in-span data
       offset, on all 358 spans. Shrub does **not** use moby's part-table format.
-      The body past `+0x2c` is not decoded — it tiles at no stride consistent
-      with the count at `+0x28`.
+      The body is **8-byte records, 6 varying bytes and 2 constant**, and now
+      that every span is bounded by the located chunk container, all 358
+      bodies are whole records — 9,600 in total. The payload's encoding is
+      still unknown, and so is the 2-byte marker that closes the region.
 - [x] `moby` — per-class model geometry. A class span opens with a `u32`
       pointing at a part table of 16-byte records; parts tile exactly, with
       `vertex_offset + 16 * vertex_count == next_part` holding for **43,467 of