Fix permanent input-timing desync; no i-frames; UI respawn; guard dead joins

The real cause of the ship/bullet separation, which the previous commit only
half-addressed. The server dropped inputs past a lead of 12 while the client
only re-synced past 16, so a client whose lead drifted into 13-16 had every
input silently rejected while believing its timing was fine. The server coasted
on held_input and then stopped; the client kept predicting. The two separated
permanently and the reconciler fought it every snapshot -- "shoved around".
It needed two independent clocks to drift, hence "only after some time", and
nothing in the loop could notice, hence "then persists". The listen-server
diagnostic could never reproduce it: one process, one physics tick, lead
constant by construction.

Two defences: INPUT_MAX_LEAD (40) is now far wider than the client's correction
band (3..20), asserted by tests/unit/test_input_lead.gd so narrowing it fails a
test; and an ack-stall detector re-syncs when last_input_tick stops advancing,
which catches the whole class regardless of cause -- lead alone cannot, because
a wrong lead looks normal from the client. diag_prediction.gd now injects a +14
tick drift and exits non-zero unless the gap recovers.

Also:
- No invulnerability frames. Every bullet that touches a player lands; i-frames
  made dense patterns safer than sparse ones, which inverts the genre. Measured:
  a stationary player survives ~13.6s of the Warden's opening phase, ~17.5s
  drifting. spawn_grace remains the only invulnerable state.
- Death is exited with a HUD button, disabled for the first 3s. The lockout is
  enforced in SimWorld, not just by graying the button -- a client that ignores
  its own UI still waits. The interact key no longer respawns.
- Joining a server that is not there no longer drops the player into an empty
  lobby they cannot act in. Net.join() only creates an ENet object; the game
  scene now waits for the server to actually place us in an instance, with an
  8s timeout, and headless runs exit non-zero instead of idling.

Protocol 2 -> 3. 98 tests; check.sh, test.sh and smoke.sh all pass.

src/ui/hud.gd

@@ -6,9 +6,12 @@ const MARGIN := 24.0
 const BAR_W := 260.0
 const BAR_H := 16.0
 
+signal respawn_pressed
+
 var _canvas: Control
 var _status: Label
 var _hint: Label
+var _respawn_button: Button
 var _hit_flash: float = 0.0
 var client: ClientRuntime = null
 
@@ -38,6 +41,20 @@ func _ready() -> void:
 	_hint.offset_left = MARGIN
 	_hint.offset_top = -56.0
 
+	# A real Button rather than something drawn in _draw_hud: this is the one
+	# HUD element the player has to actually click, and it starts disabled so
+	# death is not exited by whatever key happened to be under a finger.
+	_respawn_button = Button.new()
+	_respawn_button.custom_minimum_size = Vector2(240.0, 40.0)
+	_respawn_button.set_anchors_and_offsets_preset(Control.PRESET_CENTER)
+	_respawn_button.offset_left = -120.0
+	_respawn_button.offset_right = 120.0
+	_respawn_button.offset_top = 40.0
+	_respawn_button.offset_bottom = 80.0
+	_respawn_button.pressed.connect(func() -> void: respawn_pressed.emit())
+	_respawn_button.visible = false
+	_canvas.add_child(_respawn_button)
+
 
 func _make_label(pos: Vector2) -> Label:
 	var l := Label.new()
@@ -53,9 +70,23 @@ func _process(delta: float) -> void:
 	_hit_flash = maxf(_hit_flash - delta * 2.5, 0.0)
 	_status.text = _status_text()
 	_hint.text = _hint_text()
+	_update_respawn_button()
 	_canvas.queue_redraw()
 
 
+func _update_respawn_button() -> void:
+	var downed := client != null and not client.my_alive
+	_respawn_button.visible = downed
+	if not downed:
+		return
+	# Mirrors SimConfig.RESPAWN_LOCKOUT_TICKS, which the server enforces
+	# independently -- this is presentation, not the rule.
+	var ready := client.my_respawn_wait <= 0.0
+	_respawn_button.disabled = not ready
+	_respawn_button.text = "Return to hub" if ready \
+		else "Return to hub  (%.0fs)" % ceil(client.my_respawn_wait)
+
+
 func _status_text() -> String:
 	if client == null:
 		return "connecting..."
@@ -69,7 +100,7 @@ func _hint_text() -> String:
 	if client == null:
 		return ""
 	if not client.my_alive:
-		return "DOWN   --   press E to return to the hub"
+		return "DOWN"
 	if client.instance_kind == Protocol.InstanceKind.LOBBY:
 		return "WASD move   mouse aim   LMB fire   E on the ring to enter a dungeon   Esc menu"
 	return "WASD move   mouse aim   LMB fire   hold F to return to the hub   Esc menu"
@@ -106,9 +137,7 @@ func _draw_hud() -> void:
 		var centre := _canvas.size * 0.5
 		_canvas.draw_string(ThemeDB.fallback_font, centre - Vector2(52.0, 8.0),
 			"DOWN", HORIZONTAL_ALIGNMENT_LEFT, -1, 34, Color(1.0, 0.4, 0.4))
-		_canvas.draw_string(ThemeDB.fallback_font, centre - Vector2(118.0, -18.0),
-			"press E to return to the hub", HORIZONTAL_ALIGNMENT_LEFT, -1, 16,
-			Color(1.0, 0.75, 0.75))
+
 
 	if _hit_flash > 0.0:
 		_canvas.draw_rect(Rect2(Vector2.ZERO, _canvas.size),

src/ui/main_menu.gd

@@ -9,6 +9,8 @@ var _address: LineEdit
 var _port: LineEdit
 var _name: LineEdit
 var _status: Label
+var _join_button: Button
+var _host_button: Button
 
 
 func _ready() -> void:
@@ -43,15 +45,15 @@ func _ready() -> void:
 	_address = _field(panel, "server address", GameOpts.host_address)
 	_port = _field(panel, "port", str(GameOpts.port))
 
-	var join := Button.new()
-	join.text = "Join"
-	join.pressed.connect(_on_join)
-	panel.add_child(join)
+	_join_button = Button.new()
+	_join_button.text = "Join"
+	_join_button.pressed.connect(_on_join)
+	panel.add_child(_join_button)
 
-	var host := Button.new()
-	host.text = "Host and play (listen server)"
-	host.pressed.connect(_on_host)
-	panel.add_child(host)
+	_host_button = Button.new()
+	_host_button.text = "Host and play (listen server)"
+	_host_button.pressed.connect(_on_host)
+	panel.add_child(_host_button)
 
 	var quit := Button.new()
 	quit.text = "Quit"
@@ -78,6 +80,13 @@ func set_status(text: String) -> void:
 	_status.text = text
 
 
+## Locks the connect buttons while an attempt is in flight, so a second click
+## cannot start a competing connection over the top of the first.
+func set_busy(busy: bool) -> void:
+	_join_button.disabled = busy
+	_host_button.disabled = busy
+
+
 func _commit_name() -> void:
 	var clean := _name.text.strip_edges()
 	if not clean.is_empty():