fix(core): reject spawn intents after the spawn phase (anti-teleport) (#4657)

## Problem
Patches sending the `spawn` intent over the game WebSocket while a match
is underway:

```js
ws.send(JSON.stringify({ type: "intent", intent: { type: "spawn", tile: tileRef } }));
```

The server relays it like any intent, and `SpawnExecution.tick()` then
**relinquishes the player's entire territory and re-conquers it at the
target tile** — instant teleport anywhere on the map.

The root cause is that `SpawnExecution.tick()` had no spawn-phase gate
(only a random-spawn re-roll guard), and the engine ticks the execution
**both during and after** the spawn phase (`activeDuringSpawnPhase()` is
`true`, and after the phase `!inSpawnPhase()` is also `true`).

## Fix

Ignore a spawn intent when the game is no longer in the spawn phase
**and** the player has already spawned:

```js
if (!this.mg.inSpawnPhase() && player.hasSpawned()) {
  return;
}
```

Because `inSpawnPhase()` / `hasSpawned()` are deterministic game state,
the intent becomes a no-op identically on every client — no desync.

Unaffected:
- First-time spawns (`hasSpawned()` is false)
- In-phase spawn picks and re-picks (`inSpawnPhase()` is true)
- Existing random-spawn re-roll protection (kept as-is)

## Tests

- Added `Spawn intent after the spawn phase cannot relocate territory
(anti-teleport)` — establishes a player, then asserts a later `spawn`
intent leaves `spawnTile()` and `numTilesOwned()` unchanged.
- Simplified `Spawn on specific tile` to a single first spawn (the
previous version relied on an out-of-phase re-pick, which this fix now
correctly forbids).
- Full `tests/core` suite green (259 tests).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

src/core/execution/SpawnExecution.ts

@@ -47,6 +47,15 @@ export class SpawnExecution implements Execution {
       player = this.mg.addPlayer(this.playerInfo);
     }
 
+    // Security: a spawn intent may only place or relocate a player's starting
+    // territory during the spawn phase. Once the game is underway, an
+    // already-spawned player who sends a spawn intent is attempting to
+    // teleport — relinquishing their territory and re-conquering it elsewhere.
+    // Ignore it so the intent is a deterministic no-op on every client.
+    if (!this.mg.inSpawnPhase() && player.hasSpawned()) {
+      return;
+    }
+
     // Security: If random spawn is enabled, prevent players from re-rolling their spawn location
     if (this.mg.config().isRandomSpawn() && player.hasSpawned()) {
       return;