docs(studio-3d): 阶段 7–9 交付说明 + 接口骨架同步 + 保护包的应用侧配置

- What:
  1. `docs/architecture/studio-3d-stages.md` 新增三节：**阶段 7**（二维图像后端统一与回放入口收口，含起因、
     做法、验收表格）、**阶段 8 第一批**（能力控件/真实色标/复位语义/命名）、**阶段 9 上半**（限速、真实统计、
     无位移复用几何、保护包密钥），并新开一节「尚未完成」把两项写清楚：阶段 8 第二批（画布布局与曲线量程）与
     阶段 9 的门禁运行（GUI 2 小时长时 + 两块 ARM 板的探针/性能/长时报告），外加阶段 6 遗留的真机验证项。
     文首进度与依赖关系图同步。
  2. `docs/architecture/studio-3d-contracts.pyi`：新增 `SceneCapabilities`；`RenderStats` 增
     `paint_calls`/`scale_lower`/`scale_upper`/`scale_mode` 并注明 `displayed_frames` 是"按帧身份的唯一帧"
     而不是绘制次数；`RenderFrame` 增 `compose_ms`。
  3. `tools/scene_assets/README.md`：新增「Studio 应用侧的配置」——`scene3d_verify_key`/
     `scene3d_content_key_file` + `scene3d_content_key_id`/`scene3d_require_signature` 的用法、为什么没有验签
     公钥就打不开签名包、以及"密钥文件缺失是状态而非崩溃、记录里只留布尔与路径"。
- Why: 规格 §13 要求每阶段同时交出实现、测试、输入样例、失败样例、兼容说明与平台诊断报告；阶段 6 的文档提交
  之后又落了阶段 7/8/9 的接口改动，骨架文件必须跟上，否则下一阶段会照着过期文档实现。同时把"没做完的两项"
  写在文档里（而不是留在对话里），下一个接手的人不需要猜。
- Verification: 文档改动本身不执行测试；其中的数字全部来自本仓可复现的命令：`pytest`（shared+apps 同一次
  运行 588 项 0 失败 15 跳过）、真 GL 冒烟 14 项 0 失败、`ui_check.py` 587 项 0 失败、`locale_check.py`
  0 缺失、`bench_scene.py --cpu-only`（20k 顶点 1.03 ms / 真实包 0.17 ms）、`validate_scene.py`（重编包
  全项 ok）与两份 `.repro/probe_stage6_*.json`。
- Not in this change: 不改代码；阶段 8 第二批与阶段 9 门禁仍未做（见文档「尚未完成」一节）；ARM 板卡报告
  按用户先前的意思仍是暂缓项。

tools/scene_assets/README.md

@@ -111,6 +111,33 @@ Release gate:
   --verify-key keys\build-ed25519.pub.pem --require-signature
 ```
 
+### What the Studio application needs for a protected package
+
+The application reads the same material from its preferences file (paths only — the
+private half never leaves the build machine):
+
+```json
+{
+  "scene3d_verify_key": "C:\\keys\\build-ed25519.pub.pem",
+  "scene3d_content_key_file": "C:\\keys\\finger-display.key",
+  "scene3d_content_key_id": "finger-display",
+  "scene3d_require_signature": true
+}
+```
+
+- `scene3d_verify_key` is the **public** key `--write-verify-key` produced. Without it a
+  signed package is refused by the container ("a verification key is required"), which is
+  why the application could not open a protected release at all before this existed.
+- `scene3d_content_key_file` + `scene3d_content_key_id` are only needed for a **sealed**
+  (`aes-gcm`) package. The file may hold the key as hex, base64 or raw bytes.
+- `scene3d_require_signature` is the application's own release gate: with it on, an
+  unsigned package is refused (`asset_auth_failed`) instead of being quietly drawn.
+  Leave it off for engineering builds — the shipped `finger-display-1.0.0.oryscene` is
+  deliberately plain.
+- A missing or unreadable file is *not* a crash: the pane reports why, and the
+  two-dimensional application keeps running. `session.json` records which of these were
+  configured (booleans and paths, never key material).
+
 ## Performance and long runs
 
 ```powershell