Sync security fixes, random model placement, and smaller emote packs

Security and sync

• Fixed another way for synced skills to run console commands without rpengine.sync.console. Untrusted skills now use an allowlist that also blocks cross-world targeting, dangerous summons, and calls to server-defined metaskills. Update if you give rpengine.sync to non-operators.
• Untrusted pushes can no longer register dialog commands, Quick Actions keys, or natural mob spawning. These restrictions survive restarts. Servers using a sync server-token treat every push as untrusted.
• Dialog command targets now accept only player names, including Bedrock prefixes, so selectors such as @a cannot reach console button commands.
• A sync code already claimed on your server can no longer be reassigned by another player. Each player can try up to five codes in ten minutes.
• Skill summons are capped at 100 living summoned entities per world to prevent runaway spawning.
• Skill explosion power is capped at 16 to prevent excessive explosions from stalling the server.
• Custom spawn eggs now respect canceled clicks and model placement protection checks.
• Sync notifications now show names and pack names as plain text, preventing embedded color codes from impersonating server messages.

Models and imports

• Placed models can now receive a random rotation and scale, with optional rotation steps. Each placement keeps its variation across restarts without changing the item's original size when broken.
• Fixed missing models, textures, armor layers, and font images when importing an ItemsAdder pack whose folder name differs from its declared namespace.

Dialogs

• Stay open dialogs now refresh after console commands or multi-line command buttons run, updating placeholders and conditional buttons without replacing another screen the player has opened.
• Fixed dialog compatibility with Minecraft 1.21.

Emotes

• Emote rig packs now include only recently seen players, rather than every past visitor. Configure the limits with emotes.rig-days (30 by default) and emotes.rig-players (64 by default). Excluded players use the default rig until their rig is rebuilt.
• /emote now lists available emotes, and /emote stop stops the current emote.

Commands and permissions

• /rp and /rp help now list commands the sender can use. Loaded-content counts remain restricted to rpengine.info, and dialog button subcommands are hidden from regular player help and tab completion.
• Command usage and refusal messages now give clearer next steps and use /rp consistently.
• When sync is unavailable, players are told to retry in a minute, while connection configuration hints go to the console.
• Shader conflict warnings now use rpengine.shaders.notify, separate from the rpengine.shaders command permission. This also fixes the duplicate-permission warning at startup.