Fix: every zone change was handing the player a blank character

SimWorld knows nothing about characters, so Instance.add_peer builds a fresh
SimPlayer -- level 1, base stats, empty inventory. Something has to give that
player back its character, and only character SELECT ever did. Every portal
into a dungeon and every escape back to the hub therefore reset the player's
level, experience, upgrades and bag. The record on disk stayed correct
throughout, which is what made it read as a display glitch: the level shown was
1 because the level being played really was 1, and the first kill's experience
grant partially repaired it, so the numbers appeared to come and go.

_place now adopts, through a single _adopt_character that every transfer runs.
That let _enter_world_as drop its adopt/reset/adopt dance -- three lines that
existed only because reset_for_instance clobbered the health adopt had just
computed -- and let the level-up path derive maximum health through
recompute_max_hp instead of keeping a second copy of the formula.

diag_upgrades now walks hub -> dungeon -> hub after taking an upgrade and
asserts level, experience, upgrades, damage, maximum health and inventory all
survive each leg. With the fix reverted it reports exactly what was described:
level 1, no upgrades, base damage, empty bag. One of the new checks compared
health against a formula fed the player's own level, which agrees with itself
even when the level is wrong; it compares against the character record instead.

Also drops "(every upgrade)" from the choice cards. That a flat bonus rides
along with all of them is a design principle, not something a player needs
told -- the number is enough.

check.sh clean, 409 tests, SMOKE PASS, all four diagnostics green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -297,6 +297,15 @@ lives in `SimConfig.UPGRADE_DAMAGE_BONUS` and is applied once per upgrade held,
 rather than being baked into seven definitions where it would be seven places
 to get wrong.
 
+**A character record becomes a live player in exactly one place.**
+`ServerRuntime._adopt_character`, called from `_place`, which every transfer
+goes through. `SimWorld` knows nothing about characters and hands back a blank
+player on every instance change, so something has to give it back its level,
+upgrades and bag — and for a long time only character *select* did. Every
+portal and every escape reset the player to level 1 with base stats and an
+empty inventory, while the record on disk stayed correct, which made it look
+like a display bug.
+
 **Stats are derived from the upgrade list, never stored.** `PlayerStats.build()`
 recomputes them from the ids the character holds, the same way `Progression`
 derives level from experience. One source of truth means a saved stat can never