Fix bullet/ship desync; rework death, escape, arrival and hub awareness

(1) Bullets appeared to trail the ship. Two independent causes, measured with
the new tools/diag_prediction.gd rather than guessed at:
  - ServerRuntime ticked before ClientRuntime, so input sampled on frame N was
    not consumed until frame N+1, leaving the drawn ship a constant one tick
    (4.00px at 240 u/s) ahead of the authoritative one that bullets spawn from.
    ClientRuntime now sets process_physics_priority = -10. Gap on a listen
    server: 4.00px -> 0.10px mean, 0.30px worst.
  - PLAYER_MUZZLE_OFFSET was PLAYER_RADIUS + 6 = 12px against a 13px drawn
    ship, so bullets were born inside the sprite. Regression from the previous
    commit's hitbox shrink; it now derives from PLAYER_VISUAL_RADIUS.

(2) No more timed respawn. A downed player stays down until they ask for the
hub (E), which is an ordinary input -- the server has no "revive me" message.

(3) Escape channel 3s -> 1s, and damage no longer cancels it. An interruptible
channel makes killing the process strictly better than using the button, so a
dropped connection now runs the same channel: the player stays in the world as
linkdead, still killable, and is only released once it completes. Instances
refuse to close while a linkdead body is resolving, or a solo drop would delete
it on the next tick and hand the exploit straight back.

(4) Escape opens an in-game menu: return to hub (routed through the same held-
escape channel, not a new message), disconnect, quit.

(5) Server pushes a roster so the hub shows who is online and which dungeon
they are in. Entering a dungeon grants 2s arrival protection -- invulnerable
AND weapons-cold, since invulnerability alone would make the spawn a free
firing position -- flagged in the snapshot and drawn on every protected ship.

(6) Cleared dungeons hold the party 30s (was 5s) with a visible countdown.

(7) The hub's grey circle was a 100k-HP target dummy that read as scenery. Now
drawn as a bullseye so its purpose is legible.

Protocol version 1 -> 2. 91 tests (was 78); smoke.sh gains a bot that is
SIGKILLed mid-dungeon to prove the disconnect path end to end. check.sh,
test.sh and smoke.sh all pass.

src/core/sim_config.gd

@@ -29,6 +29,13 @@ const PLAYER_SPEED := 240.0
 const PLAYER_RADIUS := 6.0
 ## Render-only. Used by src/view/, never by anything under src/sim/.
 const PLAYER_VISUAL_RADIUS := 13.0
+## Where a player's bullets are born, measured from the ship's centre. Derived
+## from the VISUAL radius rather than the hitbox on purpose: this is the one
+## sim number whose whole job is to line up with what the player sees. Keep it
+## clear of PLAYER_VISUAL_RADIUS by a few px, or bullets appear to spawn inside
+## the ship -- and on a remote client, the ship is also drawn a tick or two
+## ahead of the server, so this margin is what absorbs that too.
+const PLAYER_MUZZLE_OFFSET := PLAYER_VISUAL_RADIUS + 6.0
 const PLAYER_MAX_HP := 100
 const PLAYER_FIRE_COOLDOWN := 7          # ticks
 const PLAYER_BULLET_SPEED := 620.0
@@ -36,7 +43,10 @@ const PLAYER_BULLET_RADIUS := 4.0
 const PLAYER_BULLET_LIFETIME := 90       # ticks
 const PLAYER_BULLET_DAMAGE := 6
 const PLAYER_IFRAMES := 36               # ticks of invulnerability after a hit
-const PLAYER_RESPAWN_DELAY := 180        # ticks
+## Invulnerable *and* unable to shoot on entering a dungeon, so arriving into a
+## live bullet field is survivable. Both halves matter: invulnerability alone
+## would make the spawn point a free firing position.
+const SPAWN_GRACE_TICKS := 120           # 2 seconds
 
 # --- Anti-cheat guards ------------------------------------------------------
 ## Inputs older than this (relative to the newest accepted) are discarded.
@@ -47,9 +57,13 @@ const INPUT_MAX_LEAD := 12
 const INPUT_MAX_PER_TICK := 4
 
 # --- Emergency escape -------------------------------------------------------
-const ESCAPE_CHANNEL_TICKS := 180        # 3 seconds
-## Taking damage while channelling cancels the escape.
-const ESCAPE_BREAK_ON_DAMAGE := true
+const ESCAPE_CHANNEL_TICKS := 60         # 1 second
+## Taking damage does NOT interrupt the channel. It used to, which sounds like
+## the right kind of risk until you notice the interaction with disconnects: if
+## a player under fire cannot escape, quitting the process is strictly better
+## than using the button, and the escape hatch becomes the cheese. A dropped
+## connection now runs the same one-second channel (see SimPlayer.linkdead),
+## which only works if being shot cannot cancel it.
 
 # --- Bullets ----------------------------------------------------------------
 const MAX_BULLETS := 4096
@@ -67,6 +81,10 @@ const LOBBY_INSTANCE_ID := 1
 const DUNGEON_PARTY_MAX := 4
 ## How long a forming dungeon waits for more players before it locks.
 const DUNGEON_FORMING_TICKS := 300
+## Victory lap: how long a cleared dungeon holds the party before returning
+## them to the hub and closing. Once closed (or once it empties), the next
+## player through the portal opens a fresh instance.
+const DUNGEON_CLEARED_EXIT_TICKS := 1800  # 30 seconds
 
 # --- Portal -----------------------------------------------------------------
 const PORTAL_POS := Vector2(0.0, -220.0)