Fix permanent input-timing desync; no i-frames; UI respawn; guard dead joins

The real cause of the ship/bullet separation, which the previous commit only
half-addressed. The server dropped inputs past a lead of 12 while the client
only re-synced past 16, so a client whose lead drifted into 13-16 had every
input silently rejected while believing its timing was fine. The server coasted
on held_input and then stopped; the client kept predicting. The two separated
permanently and the reconciler fought it every snapshot -- "shoved around".
It needed two independent clocks to drift, hence "only after some time", and
nothing in the loop could notice, hence "then persists". The listen-server
diagnostic could never reproduce it: one process, one physics tick, lead
constant by construction.

Two defences: INPUT_MAX_LEAD (40) is now far wider than the client's correction
band (3..20), asserted by tests/unit/test_input_lead.gd so narrowing it fails a
test; and an ack-stall detector re-syncs when last_input_tick stops advancing,
which catches the whole class regardless of cause -- lead alone cannot, because
a wrong lead looks normal from the client. diag_prediction.gd now injects a +14
tick drift and exits non-zero unless the gap recovers.

Also:
- No invulnerability frames. Every bullet that touches a player lands; i-frames
  made dense patterns safer than sparse ones, which inverts the genre. Measured:
  a stationary player survives ~13.6s of the Warden's opening phase, ~17.5s
  drifting. spawn_grace remains the only invulnerable state.
- Death is exited with a HUD button, disabled for the first 3s. The lockout is
  enforced in SimWorld, not just by graying the button -- a client that ignores
  its own UI still waits. The interact key no longer respawns.
- Joining a server that is not there no longer drops the player into an empty
  lobby they cannot act in. Net.join() only creates an ENet object; the game
  scene now waits for the server to actually place us in an instance, with an
  8s timeout, and headless runs exit non-zero instead of idling.

Protocol 2 -> 3. 98 tests; check.sh, test.sh and smoke.sh all pass.

src/core/sim_config.gd

@@ -42,19 +42,46 @@ const PLAYER_BULLET_SPEED := 620.0
 const PLAYER_BULLET_RADIUS := 4.0
 const PLAYER_BULLET_LIFETIME := 90       # ticks
 const PLAYER_BULLET_DAMAGE := 6
-const PLAYER_IFRAMES := 36               # ticks of invulnerability after a hit
+## There are deliberately NO invulnerability frames after a hit. In a bullet
+## hell the wall of bullets IS the threat, and i-frames turn a dense pattern
+## into a single cheap hit -- you get punished for the first bullet and gifted
+## the next thirty. Every bullet that touches you lands. Arrival protection
+## below is the one exception, and it is a transition, not a combat mechanic.
+
 ## Invulnerable *and* unable to shoot on entering a dungeon, so arriving into a
 ## live bullet field is survivable. Both halves matter: invulnerability alone
 ## would make the spawn point a free firing position.
 const SPAWN_GRACE_TICKS := 120           # 2 seconds
+## A downed player cannot leave for the hub until this has elapsed. Enforced
+## here rather than only by grey-ing out the button, because a disabled button
+## is a suggestion -- the server is the only thing a modified client cannot
+## argue with.
+const RESPAWN_LOCKOUT_TICKS := 180       # 3 seconds
 
-# --- Anti-cheat guards ------------------------------------------------------
+# --- Input timing -----------------------------------------------------------
+# The client numbers its input frames INPUT_TARGET_LEAD ahead of the server's
+# tick and re-syncs whenever its lead leaves [INPUT_LEAD_MIN, INPUT_LEAD_MAX].
+# The server accepts anything within INPUT_MAX_LEAD.
+#
+# INPUT_MAX_LEAD *must* stay comfortably above INPUT_LEAD_MAX. When it did not
+# (12 vs 16), a client whose lead drifted into the gap had every input silently
+# rejected while believing its timing was fine -- so the server coasted on a
+# stale input and the player's ship and the authoritative position separated
+# permanently. Two independent clocks have to drift for it to happen, which is
+# why it only showed up minutes in, and never recovered.
 ## Inputs older than this (relative to the newest accepted) are discarded.
 const INPUT_MAX_AGE := 30
-## Inputs claiming to be further ahead than this of the server tick are clamped.
-const INPUT_MAX_LEAD := 12
-## Hard ceiling on inputs consumed from one peer in a single tick.
-const INPUT_MAX_PER_TICK := 4
+## Where the client aims to sit.
+const INPUT_TARGET_LEAD := 8
+## The client re-syncs its numbering outside this band.
+const INPUT_LEAD_MIN := 3
+const INPUT_LEAD_MAX := 20
+## Inputs claiming to be further ahead than this of the server tick are dropped.
+const INPUT_MAX_LEAD := 40
+## Snapshots with no forward progress on last_input_tick before the client
+## assumes its numbering is out of the server's window and hard re-syncs. The
+## backstop that makes the failure above self-healing whatever its cause.
+const INPUT_ACK_STALL_LIMIT := 8
 
 # --- Emergency escape -------------------------------------------------------
 const ESCAPE_CHANNEL_TICKS := 60         # 1 second