Fix bullet/ship desync; rework death, escape, arrival and hub awareness

(1) Bullets appeared to trail the ship. Two independent causes, measured with
the new tools/diag_prediction.gd rather than guessed at:
  - ServerRuntime ticked before ClientRuntime, so input sampled on frame N was
    not consumed until frame N+1, leaving the drawn ship a constant one tick
    (4.00px at 240 u/s) ahead of the authoritative one that bullets spawn from.
    ClientRuntime now sets process_physics_priority = -10. Gap on a listen
    server: 4.00px -> 0.10px mean, 0.30px worst.
  - PLAYER_MUZZLE_OFFSET was PLAYER_RADIUS + 6 = 12px against a 13px drawn
    ship, so bullets were born inside the sprite. Regression from the previous
    commit's hitbox shrink; it now derives from PLAYER_VISUAL_RADIUS.

(2) No more timed respawn. A downed player stays down until they ask for the
hub (E), which is an ordinary input -- the server has no "revive me" message.

(3) Escape channel 3s -> 1s, and damage no longer cancels it. An interruptible
channel makes killing the process strictly better than using the button, so a
dropped connection now runs the same channel: the player stays in the world as
linkdead, still killable, and is only released once it completes. Instances
refuse to close while a linkdead body is resolving, or a solo drop would delete
it on the next tick and hand the exploit straight back.

(4) Escape opens an in-game menu: return to hub (routed through the same held-
escape channel, not a new message), disconnect, quit.

(5) Server pushes a roster so the hub shows who is online and which dungeon
they are in. Entering a dungeon grants 2s arrival protection -- invulnerable
AND weapons-cold, since invulnerability alone would make the spawn a free
firing position -- flagged in the snapshot and drawn on every protected ship.

(6) Cleared dungeons hold the party 30s (was 5s) with a visible countdown.

(7) The hub's grey circle was a 100k-HP target dummy that read as scenery. Now
drawn as a bullseye so its purpose is legible.

Protocol version 1 -> 2. 91 tests (was 78); smoke.sh gains a bot that is
SIGKILLed mid-dungeon to prove the disconnect path end to end. check.sh,
test.sh and smoke.sh all pass.

src/instances/instance.gd

@@ -49,6 +49,9 @@ static func make_dungeon(instance_id: int, dungeon_seed: int) -> Instance:
 	inst.seed_value = dungeon_seed
 	inst.world = SimWorld.new(dungeon_seed)
 	inst.world.spawn_point = Vector2(0.0, 260.0)
+	# Arriving into a fight already in progress needs a moment of protection;
+	# arriving in the hub does not.
+	inst.world.spawn_grace_ticks = SimConfig.SPAWN_GRACE_TICKS
 	inst.boss_id = Content.BOSS_WARDEN
 	inst.state = State.FORMING
 	if GameOpts.boss_rush:
@@ -68,10 +71,40 @@ func remove_peer(peer_id: int) -> void:
 	world.remove_player(peer_id)
 
 
+## Drop a peer from the send list but leave its player in the world. Used when a
+## connection dies: the body stays behind, still killable, channelling its way
+## out (see SimPlayer.linkdead), while we stop trying to send to a dead socket.
+func detach_peer(peer_id: int) -> void:
+	peers.erase(peer_id)
+	var p: SimPlayer = world.players.get(peer_id)
+	if p != null:
+		p.linkdead = true
+
+
+## Peers we still talk to. Linkdead bodies are not counted -- an instance whose
+## only occupant has dropped should wind down, not wait on a ghost.
 func is_empty() -> bool:
 	return peers.is_empty()
 
 
+## True while a dropped player is still resolving its escape channel. Keeps the
+## instance alive just long enough for that to finish.
+func has_linkdead() -> bool:
+	for p in world.players.values():
+		if p.linkdead:
+			return true
+	return false
+
+
+## Whole seconds until a cleared dungeon returns its party, or
+## Protocol.COUNTDOWN_NONE when that does not apply.
+func exit_countdown_seconds() -> int:
+	if state != State.CLEARED:
+		return Protocol.COUNTDOWN_NONE
+	return mini(int(ceil(float(stage_delay) / float(SimConfig.TICK_RATE))),
+		Protocol.COUNTDOWN_NONE - 1)
+
+
 func accepts_new_party_member() -> bool:
 	return kind == Protocol.InstanceKind.DUNGEON \
 		and state == State.FORMING \
@@ -110,7 +143,9 @@ func _step_dungeon() -> void:
 		if world.boss != null and world.boss.alive:
 			return
 		state = State.CLEARED
-		stage_delay = 300
+		stage_delay = SimConfig.DUNGEON_CLEARED_EXIT_TICKS
+		GameLog.info("instance", "instance %d CLEARED, returning party in %ds" % [
+			id, SimConfig.DUNGEON_CLEARED_EXIT_TICKS / SimConfig.TICK_RATE])
 		return
 
 	stage += 1