[Lynxifyy]

What

A C ABI for the cosmetics system, so a host that dlopens libBerryAPI.so (a launcher's native preloader) can drive it without linking BerryAPI's C++ surface.

Until now CosmeticService and the device render path were C++ only. berry/cosmetic_c.h closes that gap the same way berry/replay_c.h closed it for the replay: a plain C struct of function pointers from BERRY_GetCosmeticApi(), with a size/abi_version guard the host checks before calling a pointer and a named status on every call that can fail.

The surface

uint32_t (*reload_packs)(const char* pack_dir, const char* asset_dir);
int32_t  (*list)(BerryCosmeticAssetC* out, size_t cap, size_t* count);
uint32_t (*registry_count)(void);
int32_t  (*equip)(const char* asset_id);
int32_t  (*unequip)(int32_t slot);
int32_t  (*equipped)(int32_t slot, char* out, size_t cap);
int32_t  (*clear_loadout)(void);
int32_t  (*loadout_canonical)(char* out, size_t cap, size_t* out_len);
int32_t  (*set_loadout_canonical)(const char* text);
int32_t  (*save_preset)(const char* name);
int32_t  (*apply_preset)(const char* name);
int32_t  (*has_preset)(const char* name);
int32_t  (*preset_names)(char* names, size_t name_cap, size_t cap, size_t* count);
int32_t  (*set_local_only)(int32_t local_only);
int32_t  (*local_only)(void);
void     (*stats)(BerryCosmeticStatsC* out);
int32_t  (*set_player_model_hook)(void* target, const BerryPlayerModelBoneReaderC* reader);
void     (*clear_player_model_hook)(void);
int32_t  (*has_player_model_hook)(void);

Why the player-model hook is in the same ABI

A cosmetic resolves no bones unless the embedder installs a player-model hook, because the per-build player-render target is a signature-scan result the host owns (BerryAPI does not resolve it internally). set_player_model_hook(target, reader) installs the detour on that target and binds a host-supplied bone reader, so the surface is usable rather than existing-and-drawing-nothing. Without it the render path fails closed.

Config

BerryConfigC grew cosmetic_pack_directory and cosmetic_asset_directory, so a host can point the client at its packs through the C ABI. That is a public config layout change, so BERRY_ABI_VERSION moves 8 → 9. The world-seam struct layout is unchanged (sizeof(BerrySeamC) stays 112); only the number it reports moves with the global, matching how v3–v8 bumped it for config growth. The cosmetic surface itself has its own BERRY_COSMETIC_ABI_VERSION (1).

Shared code path

BerryClient gains public ReloadCosmeticPacks / InstallPlayerModelHook / ClearPlayerModelHook, and BuildCosmetics now calls them, so the attach path and the runtime C ABI path cannot drift.

Fail-closed contract

• BERRY_GetCosmeticApi() returns null before attach.
• A null / short / ABI-mismatched reader, a null target, no hook backend, a refused detour or an already-installed hook each return a named status and leave no hook behind.
• A malformed canonical loadout leaves the loadout untouched; an unknown asset or preset is refused by name.

Test evidence

• make test green, including the new tests/test_cosmetic_c.cpp (catalog/loadout/presets/stats round-trip, every fail-closed case, and the hook refused-without-target / installed-with-target / cleared cycle).
• tests/dlopen_test.c extended to dlsym the cosmetic surface: refused before attach, self-consistent after.
• nm -D on the built libBerryAPI.so (host and arm64-v8a) shows the five BERRY_* cosmetic symbols exported; the arm64-v8a NDK build is green.

Stacking

Based on lynxifyy/berryapi-android-build-fix (the NDK build fix), because this branch builds on that fix. Merge that first, then this one.