feat(abilities): add disasters & pandemics lever (v0.41.0, #63)

Add the 9th modular LLM ability: a turn-transient `TurnResult.disasters`
lever letting the LLM declare natural/man-made disasters (earthquake /
flood / volcanic / wildfire / famine / plague / epidemic) on a nation or
a region, applying a DETERMINISTIC (type, severity) stat dip (no hidden
randomness). Like the hybrid layer it owns no GameState field, needs no
db.ts change, and leaves no durable list — an ongoing plague/epidemic is
simply re-declared each turn it persists.

- shared/protocol.ts: DisasterType / DisasterSeverity / DisasterEvent /
  DisastersOps, and `TurnResult.disasters` (between `ideology` and
  `markers`; required, default `{ events: [] }`).
- server/abilities/disasters.ts: the ability module (validate / apply /
  schemaLine / constraint / isMeaningful / inert stub / empty payload; no
  stateFields). `DISASTER_EFFECTS` is the deterministic (type, severity)
  dip table (population never touched). Target resolution mirrors hybrid
  (a region key hits its SOLE owner; 0/2+ owners dropped) but has NO
  `from` field, so there is no self-target drop. Dips clamp to 0-100,
  mirror to the target's regions (regionStats), and re-derive the target
  nation's stats (same 0-region / no-entry guards).
- Registered last in ABILITIES (after ideology). System-prompt goldens
  regenerated (one schema line + one constraint bullet each); the
  user.txt golden stays byte-identical (payload() is {}).
- New server/abilities/disasters.test.ts (33 tests); registry.test.ts
  updated to the 9-ability contract.
- Secondary cleanups from the v0.40 refactor: AGENTS.md (abilities/ in
  the Layout tree + a "how to add a new ability" bullet + a disasters
  bullet), delete the orphaned validateTakeovers JSDoc, fold both inline
  `as unknown` casts into the top-level ./abilities import, and de-dup
  `str` (now imported from ./abilities/shared).

Version bumped 0.40.0 -> 0.41.0.

server/stub.ts

@@ -252,13 +252,13 @@ export function deterministicTurn(p: StubPayload): TurnResult {
     nationOps: [], // the stub never proposes nation ops (see doc comment)
   };
 
-  // The 8 ability fields, filled by the registry in its canonical order. The
+  // The 9 ability fields, filled by the registry in its canonical order. The
   // stub is ability-inert: every ability contributes its own no-op default
   // (each ability's `stub()` — see the per-ability doc comments above), so the
   // e2e assertions are unaffected. The insertion order here (ABILITIES) is the
   // historical key order pinned by the stub's deterministic output
   // (takeovers → wars → hybrid → economy → industry → nuclear → leaders →
-  // ideology), which must stay byte-identical.
+  // ideology → disasters), which must stay byte-identical.
   const abilities = {} as Record<AbilityField, unknown>;
   for (const a of ABILITIES) abilities[a.field] = a.stub();