fix: guard fsPath underflow, name WMO doodad mask, add why-comments

- asset_manager: add size guard before fsPath.substr(size-4) in
  tryLoadPngOverride — resolveFile could theoretically return a
  path shorter than the extension
- wmo_loader: name kDoodadNameIndexMask (0x00FFFFFF) with why-comment
  explaining the 24-bit name index / 8-bit flags packing and MODN
  string table reference
- window: add why-comment on LOG_WARNING usage during shutdown —
  intentionally elevated so teardown progress is visible at default
  log levels for crash diagnosis

src/core/window.cpp

@@ -103,6 +103,8 @@ bool Window::initialize() {
     return true;
 }
 
+// Shutdown progress uses LOG_WARNING so these messages are always visible even at
+// default log levels — useful for diagnosing hangs or crashes during teardown.
 void Window::shutdown() {
     LOG_WARNING("Window::shutdown - vkContext...");
     if (vkContext) {

src/pipeline/asset_manager.cpp

@@ -233,6 +233,7 @@ BLPImage AssetManager::tryLoadPngOverride(const std::string& normalizedPath) con
     if (fsPath.empty()) return BLPImage();
 
     // Replace .blp/.BLP extension with .png
+    if (fsPath.size() < 4) return BLPImage();
     std::string pngPath = fsPath.substr(0, fsPath.size() - 4) + ".png";
     if (!LooseFileReader::fileExists(pngPath)) {
         return BLPImage();

src/pipeline/wmo_loader.cpp

@@ -291,9 +291,11 @@ WMOModel WMOLoader::load(const std::vector<uint8_t>& wmoData) {
                 for (uint32_t i = 0; i < nDoodads; i++) {
                     WMODoodad doodad;
 
-                    // Name index (3 bytes) + flags (1 byte)
+                    // WMO doodad placement: name index packed in lower 24 bits, flags in upper 8.
+                    // The name index is an offset into the MODN string table (doodad names).
+                    constexpr uint32_t kDoodadNameIndexMask = 0x00FFFFFF;
                     uint32_t nameAndFlags = read<uint32_t>(wmoData, offset);
-                    doodad.nameIndex = nameAndFlags & 0x00FFFFFF;
+                    doodad.nameIndex = nameAndFlags & kDoodadNameIndexMask;
 
                     doodad.position.x = read<float>(wmoData, offset);
                     doodad.position.y = read<float>(wmoData, offset);