Avoid partial attachment restore teardown crash (#107)

[themuffinator]

What changed

• Hardened idAFAttachment::ClearBody() in both SP and MP for the narrow case where a failed restore leaves the attachment without a physics object.
• Preserved the normal virtual Hide() path for every fully initialized attachment.
• Added a paired save-corruption contract that locks in the narrow cleanup path and rejects a generic UpdateModelTransform() null guard.

Root cause

The attached v0.11 dump was symbolized against the exact shipped GameLib PDB. A restore error aborts map initialization and tears down a partially restored actor. Its head attachment has been allocated but has not yet received its physics pointer, so ClearBody() called Hide(), which reached idEntity::UpdateModelTransform() and dereferenced null physics. The crash occurred during error cleanup and obscured the original restore failure.

The fix performs cleanup-only teardown for that partial state (FreeModelDef() and UnlinkCombat()), while leaving ordinary runtime hiding unchanged.

Validation

• python tools/tests/savegame_corruption_contract.py
• python -m py_compile tools/tests/savegame_corruption_contract.py
• Windows x64 game-sp and game-mp compile and link
• Both hosted push and pull-request matrices: 14/14 checks passed across Windows x64, Linux x64/ARM64 GCC and Clang, and macOS Intel/ARM64

Fixes themuffinator/openQ4#107

[themuffinator]

Final hosted validation for f13391c: all 14 push and pull-request checks passed across Windows x64, Linux x64 GCC/Clang, Linux ARM64 GCC/Clang, and macOS ARM64/Intel. Engine release-note PR themuffinator/openQ4#113 has merged, so this fix can now land and close themuffinator/openQ4#107 in the intended order.