feat(abilities): add disasters & pandemics lever (v0.41.0, #63)

Add the 9th modular LLM ability: a turn-transient `TurnResult.disasters`
lever letting the LLM declare natural/man-made disasters (earthquake /
flood / volcanic / wildfire / famine / plague / epidemic) on a nation or
a region, applying a DETERMINISTIC (type, severity) stat dip (no hidden
randomness). Like the hybrid layer it owns no GameState field, needs no
db.ts change, and leaves no durable list — an ongoing plague/epidemic is
simply re-declared each turn it persists.

- shared/protocol.ts: DisasterType / DisasterSeverity / DisasterEvent /
  DisastersOps, and `TurnResult.disasters` (between `ideology` and
  `markers`; required, default `{ events: [] }`).
- server/abilities/disasters.ts: the ability module (validate / apply /
  schemaLine / constraint / isMeaningful / inert stub / empty payload; no
  stateFields). `DISASTER_EFFECTS` is the deterministic (type, severity)
  dip table (population never touched). Target resolution mirrors hybrid
  (a region key hits its SOLE owner; 0/2+ owners dropped) but has NO
  `from` field, so there is no self-target drop. Dips clamp to 0-100,
  mirror to the target's regions (regionStats), and re-derive the target
  nation's stats (same 0-region / no-entry guards).
- Registered last in ABILITIES (after ideology). System-prompt goldens
  regenerated (one schema line + one constraint bullet each); the
  user.txt golden stays byte-identical (payload() is {}).
- New server/abilities/disasters.test.ts (33 tests); registry.test.ts
  updated to the 9-ability contract.
- Secondary cleanups from the v0.40 refactor: AGENTS.md (abilities/ in
  the Layout tree + a "how to add a new ability" bullet + a disasters
  bullet), delete the orphaned validateTakeovers JSDoc, fold both inline
  `as unknown` casts into the top-level ./abilities import, and de-dup
  `str` (now imported from ./abilities/shared).

Version bumped 0.40.0 -> 0.41.0.

server/abilities/index.ts

@@ -1,8 +1,8 @@
 // The ordered LLM-ability registry.
 //
-// `ABILITIES` is the single source of truth for the 8 per-feature LLM abilities.
+// `ABILITIES` is the single source of truth for the 9 per-feature LLM abilities.
 // The engine iterates it in this order:
-//   takeovers → wars → hybrid → economy → industry → nuclear → leaders → ideology
+//   takeovers → wars → hybrid → economy → industry → nuclear → leaders → ideology → disasters
 // for (a) the system-prompt schema lines + constraint bullets, (b) the per-ability
 // validate calls inside validateTurnResult, (c) the payload fields in buildUserPrompt,
 // (d) the ordered apply block inside applyTurnResult, (e) the isMeaningful check,
@@ -22,10 +22,11 @@ import { industry } from './industry';
 import { nuclear } from './nuclear';
 import { leaders } from './leaders';
 import { ideology } from './ideology';
+import { disasters } from './disasters';
 import type { Ability, AbilityField } from './types';
 
 /**
- * The 8 per-feature LLM abilities in their canonical apply order.
+ * The 9 per-feature LLM abilities in their canonical apply order.
  * The order matters: it determines the order of the schema lines in the
  * system prompt, the order of the validate calls, the order of the apply
  * steps, and the order of the payload fields in the user prompt.
@@ -39,6 +40,7 @@ export const ABILITIES: readonly Ability<AbilityField>[] = [
   nuclear,
   leaders,
   ideology,
+  disasters,
 ];
 
 // ── type re-exports ────────────────────────────────────────────────────────────
@@ -125,3 +127,15 @@ export {
 export {
   validateIdeologyOps,
 } from './ideology';
+
+// ── disasters ────────────────────────────────────────────────────────────────
+
+export {
+  validateDisasterEvents,
+  applyDisasterEvent,
+  isDisasterType,
+  isDisasterSeverity,
+  DISASTER_TYPES,
+  DISASTER_SEVERITIES,
+  DISASTER_EFFECTS,
+} from './disasters';