Documentation pass for a cold start

Audited the whole set rather than appending to it, and the two files a fresh
session reads first were both wrong.

README claimed the emergency escape takes three seconds and is CANCELLED BY
DAMAGE. It takes one, and damage explicitly does not interrupt it -- that is a
settled decision with its own entry in DECISIONS.md, and the front page said
the opposite. It also described one stationary boss, one hub portal, and none
of characters, permadeath, levels, inventory, loot, upgrades, settings or
credits. Rewritten, with the "not ready for the internet" warning made explicit.

ROADMAP had no "what is next" at all: every stage reads *done*, which for a
cold start is a dead end. It opens with where things stand and a table of
candidates -- auth, a reason to play past level 15, an economy, hit feedback,
replacing the non-redistributable packs, DTLS -- each with what blocks it, and
says plainly that the user has chosen none of them. Open questions renumbered
from the orphaned 8-11 they were left at, with the solved one dropped and three
real ones added.

ARCHITECTURE's file map listed two files twice, missed five subsystems
(upgrades, stats, poison, settings, credits, the UI theme), and still said
MapGen.build() is "the entry point both sides use" -- it is server-only, and
the whole anti-map-hack story depends on that. Rebuilt by layer and audited
against the tree: every path listed exists, and every one of the 64 source
files is covered.

CLAUDE.md's security paragraph said a client can send "exactly two things"
plus two roster requests. There are five client -> server messages. That number
is the security model, so it is now a table naming each one and what it
carries. Also records that nothing automated can see the screen.

Smaller: a stale 156/156 test count in ASSETS.md, and test counts refreshed to
468 where they are quoted.

check.sh clean, 468 tests, SMOKE PASS, all four diagnostics green, no broken
internal links.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/ASSETS.md

@@ -51,9 +51,11 @@ modification.
 
 So they live in `assets/local/`, which is gitignored. `Art.bullets_texture()`
 and `Art.impact_texture()` load them at runtime if present and return null if
-not; the bullet renderer falls back to a generated dot. Verified both ways: with
-the files present the game uses them, and with them hidden the suite still
-passes 156/156 and the game runs.
+not; the bullet renderer falls back to a generated dot. Verified both ways: with the files
+present the game uses them, and with them hidden the whole suite still passes
+and the game runs — `tests/unit/test_art.gd` has an explicit case for their
+absence, because a clean clone is the configuration most contributors will
+actually have.
 
 This is also why nothing there may be `preload()`ed — `preload` resolves at
 compile time and would fail the build on every machine that lacks the files.