Fix crashes and TXD slot leaks in model cleanup

[HeresHavi]

Summary

Added lower-bound and overflow-safe ID checks to engineFreeModel, engineFreeTXD, and the shared model lookup.

Valid TXD cleanup now uses the model manager's removal path so affected models are reset, the allocation is removed, and the pool slot can be reused.

Motivation

CClientModelManager::FindModelByID checked only the upper boundary. A negative model ID could therefore index memory before the model array. Large TXD IDs could also wrap into a negative internal model ID before reaching the same lookup.

For example, a resource might cache custom model and TXD IDs so it can free them during a restart. If an invalid model ID or wrapped TXD ID reaches cleanup, the old lookup could crash every player running that resource.

Valid engineFreeTXD calls also returned true without fully removing the allocation. The TXD slot remained occupied for the rest of the client session instead of becoming reusable.

engineFreeModel Crash Stack

Exception: Access violation
Module: client_d.dll
Offset: 0x001CCADA

engineFreeModel(-1000000)
CClientModelManager::FindModelByID (CClientModelManager.cpp:95)

engineFreeTXD Crash Stack

Exception: Access violation
Module: client_d.dll
Offset: 0x001CCADA

engineFreeTXD(4293947296)
CClientModelManager::FindModelByID (CClientModelManager.cpp:95)

Test plan

Runtime

• Before Fix: engineFreeModel(-1000000) caused an access violation in CClientModelManager::FindModelByID.
• Before Fix: engineFreeTXD(4293947296) wrapped into the same invalid lookup and crashed at the same client offset.
• After Fix: Both invalid calls returned false, and the client stayed open.
• Valid Case: Requested model ID 332 and TXD ID 3608 were freed successfully.
• TXD Cleanup: Freeing TXD 3608 reset the model using it, and the next TXD allocation reused slot 3608.
• Repeated Free: Freeing the already released TXD returned false.

Builds and Tests

• Debug | Win32: Solution build passed, 304 client tests passed.
• Release | Win32: Solution build passed, 304 client tests passed.
• Ran clang-format.

Checklist

• Your code should follow the coding guidelines.
• Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.