Fix permanent input-timing desync; no i-frames; UI respawn; guard dead joins

The real cause of the ship/bullet separation, which the previous commit only
half-addressed. The server dropped inputs past a lead of 12 while the client
only re-synced past 16, so a client whose lead drifted into 13-16 had every
input silently rejected while believing its timing was fine. The server coasted
on held_input and then stopped; the client kept predicting. The two separated
permanently and the reconciler fought it every snapshot -- "shoved around".
It needed two independent clocks to drift, hence "only after some time", and
nothing in the loop could notice, hence "then persists". The listen-server
diagnostic could never reproduce it: one process, one physics tick, lead
constant by construction.

Two defences: INPUT_MAX_LEAD (40) is now far wider than the client's correction
band (3..20), asserted by tests/unit/test_input_lead.gd so narrowing it fails a
test; and an ack-stall detector re-syncs when last_input_tick stops advancing,
which catches the whole class regardless of cause -- lead alone cannot, because
a wrong lead looks normal from the client. diag_prediction.gd now injects a +14
tick drift and exits non-zero unless the gap recovers.

Also:
- No invulnerability frames. Every bullet that touches a player lands; i-frames
  made dense patterns safer than sparse ones, which inverts the genre. Measured:
  a stationary player survives ~13.6s of the Warden's opening phase, ~17.5s
  drifting. spawn_grace remains the only invulnerable state.
- Death is exited with a HUD button, disabled for the first 3s. The lockout is
  enforced in SimWorld, not just by graying the button -- a client that ignores
  its own UI still waits. The interact key no longer respawns.
- Joining a server that is not there no longer drops the player into an empty
  lobby they cannot act in. Net.join() only creates an ENet object; the game
  scene now waits for the server to actually place us in an instance, with an
  8s timeout, and headless runs exit non-zero instead of idling.

Protocol 2 -> 3. 98 tests; check.sh, test.sh and smoke.sh all pass.

tools/diag_prediction.gd

@@ -8,10 +8,19 @@ extends Node
 ## Runs the real listen-server path (ServerRuntime + ClientRuntime + the actual
 ## Net loopback), not a mock, so node process order is exactly production's.
 
+## Tick at which to shove the client's input numbering out of sync, simulating
+## the clock drift between two independent processes that produced the original
+## "ship and bullets separate after a few minutes, permanently" bug. 0 disables.
+const DRIFT_AT := 120
+const DRIFT_BY := 14
+
 var _ticks: int = 0
 var _worst: float = 0.0
 var _sum: float = 0.0
 var _samples: int = 0
+## Measured only after the injected drift, which is the interesting window.
+var _worst_after_drift: float = 0.0
+var _drifted: bool = false
 
 
 func _ready() -> void:
@@ -42,6 +51,17 @@ func _physics_process(_delta: float) -> void:
 		_sum += delta_px
 		_samples += 1
 
+	if DRIFT_AT > 0 and _ticks == DRIFT_AT:
+		# Exactly what two drifting clocks do, only instantly. With the old
+		# constants this landed in the gap between "server stops accepting" and
+		# "client notices", and the two never re-converged.
+		cli.input_tick += DRIFT_BY
+		_drifted = true
+		print("--- injected +%d tick input drift ---" % DRIFT_BY)
+	# Give the client a moment to notice before judging it.
+	if _drifted and _ticks > DRIFT_AT + 90:
+		_worst_after_drift = maxf(_worst_after_drift, delta_px)
+
 	if _ticks % 20 == 0:
 		print("tick=%4d srv_tick=%4d srv_pos=%-22s pred=%-22s gap=%6.2fpx acked=%4d cli_tick=%4d queue=%d" % [
 			_ticks, inst.world.tick, str(sp.pos.round()), str(cli.predicted_pos.round()),
@@ -55,5 +75,12 @@ func _physics_process(_delta: float) -> void:
 		print("muzzle offset = %.1fpx, drawn ship radius = %.1fpx, hitbox = %.1fpx" % [
 			SimConfig.PLAYER_MUZZLE_OFFSET, SimConfig.PLAYER_VISUAL_RADIUS,
 			SimConfig.PLAYER_RADIUS])
+		var ok := true
+		if _drifted:
+			print("RECOVERED gap after drift: worst=%.2fpx" % _worst_after_drift)
+			# One tick of movement is 4px; anything near that means the client
+			# re-synced. Tens of px means it is stuck, which is the bug.
+			ok = _worst_after_drift < 12.0
+			print("DRIFT_RECOVERY_" + ("PASS" if ok else "FAIL"))
 		Net.shutdown()
-		get_tree().quit(0)
+		get_tree().quit(0 if ok else 1)