Fix bullet/ship desync; rework death, escape, arrival and hub awareness

(1) Bullets appeared to trail the ship. Two independent causes, measured with
the new tools/diag_prediction.gd rather than guessed at:
  - ServerRuntime ticked before ClientRuntime, so input sampled on frame N was
    not consumed until frame N+1, leaving the drawn ship a constant one tick
    (4.00px at 240 u/s) ahead of the authoritative one that bullets spawn from.
    ClientRuntime now sets process_physics_priority = -10. Gap on a listen
    server: 4.00px -> 0.10px mean, 0.30px worst.
  - PLAYER_MUZZLE_OFFSET was PLAYER_RADIUS + 6 = 12px against a 13px drawn
    ship, so bullets were born inside the sprite. Regression from the previous
    commit's hitbox shrink; it now derives from PLAYER_VISUAL_RADIUS.

(2) No more timed respawn. A downed player stays down until they ask for the
hub (E), which is an ordinary input -- the server has no "revive me" message.

(3) Escape channel 3s -> 1s, and damage no longer cancels it. An interruptible
channel makes killing the process strictly better than using the button, so a
dropped connection now runs the same channel: the player stays in the world as
linkdead, still killable, and is only released once it completes. Instances
refuse to close while a linkdead body is resolving, or a solo drop would delete
it on the next tick and hand the exploit straight back.

(4) Escape opens an in-game menu: return to hub (routed through the same held-
escape channel, not a new message), disconnect, quit.

(5) Server pushes a roster so the hub shows who is online and which dungeon
they are in. Entering a dungeon grants 2s arrival protection -- invulnerable
AND weapons-cold, since invulnerability alone would make the spawn a free
firing position -- flagged in the snapshot and drawn on every protected ship.

(6) Cleared dungeons hold the party 30s (was 5s) with a visible countdown.

(7) The hub's grey circle was a 100k-HP target dummy that read as scenery. Now
drawn as a bullseye so its purpose is legible.

Protocol version 1 -> 2. 91 tests (was 78); smoke.sh gains a bot that is
SIGKILLed mid-dungeon to prove the disconnect path end to end. check.sh,
test.sh and smoke.sh all pass.

src/view/game_scene.gd

@@ -5,6 +5,7 @@ extends Node2D
 
 @onready var world_view: Node2D = $WorldView
 @onready var hud: CanvasLayer = $HUD
+@onready var menu: CanvasLayer = $GameMenu
 
 var _bound: ClientRuntime = null
 
@@ -12,6 +13,8 @@ var _bound: ClientRuntime = null
 func _ready() -> void:
 	world_view.position = get_viewport_rect().size * 0.5
 	get_viewport().size_changed.connect(_recentre)
+	menu.return_to_hub_requested.connect(_on_return_to_hub)
+	menu.disconnect_requested.connect(_on_disconnect)
 
 
 func _recentre() -> void:
@@ -23,6 +26,20 @@ func _process(_delta: float) -> void:
 		_bound = Net.client
 		if _bound != null and not _bound.local_hit.is_connected(_on_local_hit):
 			_bound.local_hit.connect(_on_local_hit)
+	menu.set_in_dungeon(_bound != null
+		and _bound.instance_kind == Protocol.InstanceKind.DUNGEON)
+
+
+## Routed through the same held-escape channel the F key uses, rather than a
+## direct "teleport me" message -- the server has no such message, and adding
+## one would hand clients an instant, uninterruptible exit.
+func _on_return_to_hub() -> void:
+	if _bound != null:
+		_bound.request_escape = true
+
+
+func _on_disconnect() -> void:
+	Net.shutdown()
 
 
 func _on_local_hit(_damage: int) -> void: