Fix bullet atlas, animation speed, sprite flip, fire rate, silent shots

Bullet sprites were wrong because I read the pack's layout backwards. Each of
its 8 PNGs is one ANIMATION FRAME, and a column within a file is a COLOUR
variant -- so walking columns cycled the palette while the shape sat still, and
the rows I picked were in a region of larger multi-cell sprites, which is the
scattered debris that showed on screen. tools/build_local_assets.py now composes
a proper atlas: 8 frames across, one row per SimConfig.KIND_*.

Animations ran at whatever the machine's framerate was, because they counted
_process calls. At 240fps that is four times too fast on its own, before the
requested halving. Both actor and bullet animation are now driven by elapsed
seconds, so they look the same on any machine.

The knight shifted sideways instead of mirroring: a Rect2 with negative width
does not flip, the draw call normalises it, so the sprite kept its orientation
and jumped right by its own width. Mirrored through the canvas transform about
the sprite's centre instead.

Shots were silent when a bullet spawned inside an enemy. The sound rode on
BULLET_SPAWN, which is deliberately suppressed for a bullet resolved and removed
within the same tick -- so no event, no sound, and this got more likely the
closer you stood. Firing is now its own event (PLAYER_FIRED): the shot happened
whether or not a bullet survived to be replicated. Protocol 3 -> 4, because
inserting mid-enum shifts the wire value of every event after it.

Fire cooldown 7 -> 14 ticks (4.3 shots/sec).

Licence question 2, confirmed verbatim: the paid tier DOES grant commercial use
("You may use these assets in personal, commercial or non-commercial
projects"), but its next sentence still forbids redistribution "no matter how
much you modify it". Paying moves these from local-only-and-non-commercial to
local-only-and-commercial; it never makes them committable. Only replacing them
with permissively licensed art does that.

Question 3: CREDITS.md now credits every pack, including the two whose licences
do not require it and the unused ones in considering_dont_use_yet/.

158 tests. check.sh, test.sh and smoke.sh pass.

docs/ASSETS.md

@@ -28,8 +28,8 @@ be — so they are not in the repository.
 | --- | --- | --- | --- | --- |
 | [0x72 DungeonTileset II](https://0x72.itch.io/dungeontileset-ii) | **CC0 1.0** (public domain) | Yes | Not required | **Yes** — `assets/sprites/dungeon_tileset.png` |
 | [Helton Yan Pixel Combat](https://heltonyan.itch.io/pixelcombat) | **CC BY 4.0** | Yes | **Required** | **Yes** — `assets/audio/sfx/` |
-| [Fire Pixel Bullet 16x16](https://bdragon1727.itch.io/fire-pixel-bullet-16x16) | Custom | **Non-commercial only** unless you contribute | Encouraged | **No** — local only |
-| [750+ Effect and FX Pixel All](https://bdragon1727.itch.io/750-effect-and-fx-pixel-all) | Custom | **Non-commercial only** unless you contribute | Encouraged | **No** — local only |
+| [Fire Pixel Bullet 16x16](https://bdragon1727.itch.io/fire-pixel-bullet-16x16) | Custom | Free tier non-commercial; **paid tier allows commercial** | Encouraged | **No, at any tier** — local only |
+| [750+ Effect and FX Pixel All](https://bdragon1727.itch.io/750-effect-and-fx-pixel-all) | Custom | Free tier non-commercial; **paid tier allows commercial** | Encouraged | **No, at any tier** — local only |
 
 ### The blocking clause
 
@@ -62,11 +62,21 @@ compile time and would fail the build on every machine that lacks the files.
    a file in the source tree once the game ships. Players need to be able to
    see it. [CREDITS.md](../CREDITS.md) records it for now; an in-game credits
    screen is a todo.
-2. **Both bdragon packs are non-commercial in their free tier.** The stated
-   goal is a Steam release. Before that happens they need either a paid
-   contribution to bdragon1727 (which permits commercial use but still not
-   redistribution) or replacement with CC0 art. A CC0 replacement solves both
-   problems at once and lets the assets go back in the repo.
+2. **Both bdragon packs are non-commercial in their free tier.** Buying the
+   full tier *does* fix that — confirmed verbatim from the FX pack's paid
+   licence: "You may use these assets in personal, commercial or
+   non-commercial projects."
+
+   It does **not** fix the repository problem. The paid licence's very next
+   sentence is: "You can NOT re-distribute the file, no matter how much you
+   modify it you can use it but not share or re-sell it." Redistribution is
+   forbidden at every tier, so paying moves these assets from
+   *local-only-and-non-commercial* to *local-only-and-commercial*. They cannot
+   be committed to a public repo at any price.
+
+   The only route that puts bullet and FX art back into the repository is
+   replacing it with something permissive (CC0, or CC BY with attribution),
+   which would also remove the local-asset fallback machinery.
 
 ### Not in use