Fix permanent input-timing desync; no i-frames; UI respawn; guard dead joins

The real cause of the ship/bullet separation, which the previous commit only
half-addressed. The server dropped inputs past a lead of 12 while the client
only re-synced past 16, so a client whose lead drifted into 13-16 had every
input silently rejected while believing its timing was fine. The server coasted
on held_input and then stopped; the client kept predicting. The two separated
permanently and the reconciler fought it every snapshot -- "shoved around".
It needed two independent clocks to drift, hence "only after some time", and
nothing in the loop could notice, hence "then persists". The listen-server
diagnostic could never reproduce it: one process, one physics tick, lead
constant by construction.

Two defences: INPUT_MAX_LEAD (40) is now far wider than the client's correction
band (3..20), asserted by tests/unit/test_input_lead.gd so narrowing it fails a
test; and an ack-stall detector re-syncs when last_input_tick stops advancing,
which catches the whole class regardless of cause -- lead alone cannot, because
a wrong lead looks normal from the client. diag_prediction.gd now injects a +14
tick drift and exits non-zero unless the gap recovers.

Also:
- No invulnerability frames. Every bullet that touches a player lands; i-frames
  made dense patterns safer than sparse ones, which inverts the genre. Measured:
  a stationary player survives ~13.6s of the Warden's opening phase, ~17.5s
  drifting. spawn_grace remains the only invulnerable state.
- Death is exited with a HUD button, disabled for the first 3s. The lockout is
  enforced in SimWorld, not just by graying the button -- a client that ignores
  its own UI still waits. The interact key no longer respawns.
- Joining a server that is not there no longer drops the player into an empty
  lobby they cannot act in. Net.join() only creates an ENet object; the game
  scene now waits for the server to actually place us in an instance, with an
  8s timeout, and headless runs exit non-zero instead of idling.

Protocol 2 -> 3. 98 tests; check.sh, test.sh and smoke.sh all pass.

src/net/net_codec.gd

@@ -27,8 +27,6 @@ static func encode_snapshot(world: SimWorld,
 		var flags := 0
 		if p.alive:
 			flags |= Protocol.F_ALIVE
-		if p.iframes > 0:
-			flags |= Protocol.F_INVULN
 		if p.escape_ticks > 0:
 			flags |= Protocol.F_ESCAPING
 		if p.spawn_grace > 0:
@@ -37,6 +35,9 @@ static func encode_snapshot(world: SimWorld,
 			flags |= Protocol.F_LINKDEAD
 		b.put_u8(flags)
 		b.put_u8(clampi(roundi(p.escape_progress() * 255.0), 0, 255))
+		# Whole ticks are more than the HUD needs; a byte of tenths of a second
+		# covers the lockout with room to spare.
+		b.put_u8(clampi(roundi(float(p.respawn_lockout) / 6.0), 0, 255))
 		# Echoed so the owning client knows how far to rewind when reconciling.
 		b.put_u32(p.last_input_tick)
 
@@ -85,6 +86,7 @@ static func decode_snapshot(data: PackedByteArray) -> Dictionary:
 			"hp": b.get_u16(),
 			"flags": b.get_u8(),
 			"escape": float(b.get_u8()) / 255.0,
+			"respawn_wait": float(b.get_u8()) / 10.0,
 			"last_input_tick": b.get_u32(),
 		})