Honor custom GameLibs path in settings validation

[themuffinator]

Summary

• make settings_menu_coverage.py honor OPENQ4_GAMELIBS_REPO, matching the validation runner and the rest of the GameLib-aware tests
• resolve the configured checkout before reading SP/MP cvar sources
• pin the environment-variable contract in validation hardening coverage

Why

The test silently hardcoded the sibling ../openQ4-game checkout. A caller using openq4_validate.py --game-libs-repo ... could therefore validate settings against the wrong GameLib revision even though the runner printed and exported the requested path.

Validation

• settings_menu_coverage.py passed against the workflow-pinned openQ4-game commit through a non-default .tmp worktree
• an import probe confirmed a distinct custom path is selected before any source reads
• validation_hardening.py
• py_compile
• git diff --check

[themuffinator]

CI gate summary before merge:

• The complete Commit Validation workflow passed, including Windows, Linux x64 ASan+UBSan, Linux ARM64, all Wayland variants, all four macOS architecture/bridge jobs, and both universal2 assemblies.
• Linux ARM64 cross-build and the normal Windows/Linux push jobs passed.
• The only failures are the four macOS Push Verification renderer-smoke jobs. The same four jobs are already failing on the current main baseline run: https://github.com/themuffinator/openQ4/actions/runs/32992669468. Branch run: https://github.com/themuffinator/openQ4/actions/runs/33002644028.
• This PR changes only the settings coverage validator's GameLibs-root lookup and its regression test; it does not change renderer, package, or runtime code.

I am treating those four red push checks as inherited baseline failures, not a regression in this isolated validator fix.