Hub character swapping, XP percentage, passive health regeneration

Character swapping is hub-only, and refused by the SERVER rather than merely
greyed out in the menu. Allowing it inside a dungeon would be an instant,
uninterruptible exit from danger -- strictly better than the one-second escape
channel, which would make that channel pointless. Creating a character in a
dungeon is refused for the same reason. Both are covered by diag_progression.

Health regenerates at 0.5% of MAXIMUM per second. A percentage rather than a
flat rate so it does not become irrelevant at level 15: a capped character
regains 1.2 hp/s against a level 1's 0.5, and both take about 200 seconds to
heal from nothing. No out-of-combat gate -- at this rate it cannot out-heal
anything actually shooting at you, and a trickle that never stops is easier to
reason about than a timer players have to learn. A fractional carry is needed
because a tick heals well under one hit point, so truncating each tick would
heal exactly nothing; there is a test for that specifically.

The XP bar now states the percentage and the level it leads to, since a bar
answers "how far" vaguely and a number answers it exactly.

Recorded the two Stage 3 answers: 4 inventory slots, and the boss's food item
is player-instanced now so the mechanism gets exercised rather than deferred.

Writing the swap guard's test caught my own mistake: the first version created
its spare character through the store, which has no opinion about where you
are, so it bypassed the guard it was meant to prove and left a stray character
behind that broke a later assertion.

200 tests. check.sh, test.sh, smoke.sh and both diagnostics pass.

src/ui/game_menu.gd

@@ -9,9 +9,11 @@ extends CanvasLayer
 signal resumed
 signal return_to_hub_requested
 signal disconnect_requested
+signal characters_requested
 
 var _panel: VBoxContainer
 var _hub_button: Button
+var _characters_button: Button
 var _disconnect_button: Button
 var _note: Label
 var _in_dungeon: bool = false
@@ -55,6 +57,9 @@ func _ready() -> void:
 	_hub_button = _button("Return to hub", func() -> void:
 		return_to_hub_requested.emit()
 		close())
+	_characters_button = _button("Change character", func() -> void:
+		characters_requested.emit()
+		close())
 	_button("Resume", func() -> void: close())
 	_disconnect_button = _button("Disconnect to menu", func() -> void:
 		disconnect_requested.emit()
@@ -108,6 +113,12 @@ func set_in_dungeon(in_dungeon: bool) -> void:
 		return
 	_in_dungeon = in_dungeon
 	_hub_button.disabled = not in_dungeon
+	# Swapping is hub-only, and the server enforces that regardless of what
+	# this button does -- but a disabled button explains the rule, where a
+	# refusal after the fact just looks broken.
+	_characters_button.disabled = in_dungeon
+	_characters_button.text = "Change character  (hub only)" if in_dungeon \
+		else "Change character"
 	if in_dungeon:
 		# Disconnecting is not an escape: the server keeps the body in the
 		# world, channelling out, for the same second the escape button costs.