feat(reverse): inject controlled original ball states

Add an atomic live-state injector for the traceable Wine process. It updates
all recovered global and object copies of ball position and velocity while the
process is stopped, clears pending impulses, and re-enables normal collision
processing before resuming the unmodified executable.

This makes individual walls, circles, gates, and mechanisms reachable without
relying on random gameplay. Document the first controlled claw probe, including
its original terminal-18 animation, exact release state, and three-substep
gravity behavior.

Test Plan:
- `ruff check original/tools/trace_original_state.py original/tools/inject_original_state.py` -- passed
- controlled `(289,94)` injection and one-second live claw trace -- passed
- terminal-18 release matched `(325000,92000)` and `(0,1000)` -- passed
- `shellcheck original/tools/run_traceable_original.sh` -- passed
- `git diff --cached --check` -- passed

original/MECHANICS_PROGRESS.md

@@ -55,8 +55,9 @@ renamed.
   claw cadence independently of render rate.
 - Transcribe the full fixed-point flipper impulse calculation, then compare it
   with the Rust floating-point collision response.
-- Force a chosen claw terminal in the live original and compare its complete
-  frame/trajectory sequence with the deterministic Rust trace.
+- Force each chosen claw terminal in the live original and compare its complete
+  frame/trajectory sequence with the deterministic Rust trace. A controlled
+  collision probe has covered terminal 18; terminals 1, 6, and 7 remain.
 
 Those items are intentionally not counted as semantic parity. The readable
 C file preserves their raw constants and labels the unresolved conversion so a
@@ -70,11 +71,9 @@ state. Down was then held for 1.1 seconds and released; captures confirmed that
 the original plunger advances while held and launches only on release.
 
 The Rust validation mode captured the corresponding started and half-charge
-states plus closing and release frames for claw terminal 6. The original claw
-was not forced into a chosen terminal during the live session, so its claw
-parity evidence remains the decoded `1000:c79c`/`1000:eab1` control flow,
-millipixel/Real48 constants, sprite sheet, and deterministic Rust traces rather
-than a claimed live trajectory comparison.
+states plus closing and release frames for claw terminal 6. That original live
+session did not reach the claw; the controlled tracing described below later
+captured an original terminal-18 sequence.
 
 ## Live fixed-point tracing
 
@@ -93,3 +92,23 @@ The sampler records original millipixel positions, predicted positions,
 velocities, flipper inputs and states, and claw animation state whenever any of
 them changes. It neither patches `TDKPIN.EXE` nor pauses Wine. The tracing helper
 is Linux-only development infrastructure; it is not part of the Rust replica.
+
+`tools/inject_original_state.py` briefly stops the opted-in process and updates
+all recovered copies of the ball position and velocity atomically. This permits
+repeatable probes at individual walls, circles, gates, and mechanism triggers:
+
+```sh
+original/tools/inject_original_state.py --x 289 --y 94 --vx 0 --vy 0
+```
+
+The executable image remains unchanged; only the current disposable Wine
+process is modified. Run the injector while the ball is waiting in the launcher
+so it can identify the live game object, or supply the previously reported
+`--object-base` during a sequence of probes.
+
+A probe at `(289,94)` captured the original terminal-18 path. The collision
+suspended the ball while frames advanced from 10 through 18 at the configured
+30 ms cadence. Release assigned `(325000,92000)` and `(0,1000)` millipixels,
+then cleared suspension during the same timer callback. The three default
+physics substeps each added 15 millipixels of vertical velocity, confirming the
+observed total gravity increment of 45 per timer tick.