Add a first-party MDL mod-build system and reorganize modding/ under src/

modding/mods/ holds message edits as plain JSON (type, index, language,
plus only the changed fields - a long body can live in a sibling .txt to
avoid escaping in JSON), so mod authoring is reviewable in git instead of
living only in hacked's GUI. mdlp (modding/src/mdlp/, its own Docker image
mdlp-image/) turns them into the same mod folder/zip hacked's own Save
produces, reusing hacked's ss1/edit, ss1/world and ss1/content/text
packages via a go.mod replace - no GUI/GLFW/GTK needed. `make mods`
builds every mod into dist/mods/<name>/, scoped per-mod so it never
touches hacked's own build output; `make` (no target) now builds both.

Fixes a bug this surfaced: hacked's FileLocation.AbsolutePathFrom
silently writes into the current directory instead of the given output
folder when passed a relative path (the GUI never hits this since its
folder picker is always absolute) - mdlp now resolves its own paths
up front.

res/run-mods.sh/.bat are new companion launchers to run.sh/.bat: they
pass every dist/mods/*/mod folder to the engine as a separate absolute
argument, since ProcessModDirectory() only scans one directory level
deep. Wired into `make dist`/`dist-win` only, not the release archives.

modding/hacked/, its patches, sqweek-dialog/, its patches, and the new
mdlp/ move under modding/src/, separating source from the surrounding
Docker/script scaffolding; all path references updated to match.

NOTICE.txt gains a section for hacked's distributed build, listing hacked
(New BSD), sqweek/dialog (ISC - corrected from a wrong "New BSD" note),
and hacked's other direct Go dependencies.

modding/mdlp-image/docker-entrypoint.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Drops from root (needed to read the Go toolchain and module cache under
+# /usr/local/go and /opt/go) to a user matching the host's UID/GID, so
+# anything written into the bind-mounted repo (modding/dist/, ...) is owned
+# by the host user instead of root.
+set -euo pipefail
+
+USER_UID="${HOST_UID:-1000}"
+USER_GID="${HOST_GID:-1000}"
+
+groupadd -g "$USER_GID" builder 2>/dev/null || true
+useradd -u "$USER_UID" -g "$USER_GID" -m -s /bin/bash builder 2>/dev/null || true
+
+# /workspace (the bind-mounted repo) may actually be owned by a group the
+# host user only has via *supplementary* membership rather than their
+# primary GID above - e.g. a VirtualBox vboxsf shared folder, which shows
+# up as root:vboxsf on the host and would otherwise be inaccessible to
+# `builder` here (falls through to "other", which vboxsf's default mode
+# leaves with no permissions at all). Join whatever group actually owns
+# /workspace too, if it differs.
+WORKSPACE_GID="$(stat -c %g /workspace 2>/dev/null || true)"
+if [ -n "$WORKSPACE_GID" ] && [ "$WORKSPACE_GID" != "$USER_GID" ]; then
+    groupadd -g "$WORKSPACE_GID" workspace 2>/dev/null || true
+    usermod -aG "$WORKSPACE_GID" builder 2>/dev/null || true
+fi
+
+# The Go module cache under /opt/go was populated as root at image-build
+# time (see Dockerfile) - readable by anyone, but go build also wants to
+# write GOCACHE (build cache) under there by default. Point it at a
+# per-run tmpfs-friendly location inside the builder's own home instead of
+# fighting permissions on the image's baked-in GOPATH.
+export GOCACHE=/home/builder/.cache/go-build
+export GOMODCACHE=/opt/go/pkg/mod
+
+exec gosu builder "$@"