Rebuild gameplay foundation and productionize core systems

[Vinay-003]

Scope

This is the single combined gameplay rebuild PR requested after the menu/UI foundation was merged. The work is split into focused commits inside this PR rather than separate PRs.

Commits and systems

1. Authoritative server runtime

   • Replaces the 1,000+ line mixed bootstrap with a smaller validated runtime.
   • Adds per-action remote rate limits.
   • Rejects NaN/infinite vectors, invalid aim directions, distant client origins, duplicate/invalid decks, invalid hero slots, and unsupported modes.
   • Protects match start behind confirmed decks and ready/admin/solo rules.
   • Removes client-controlled global SFX rebroadcasting.
   • Disables unfinished Bomb paths instead of exposing insecure planting/defusing.
   • Makes practice dummy creation rate-limited and one-per-player.

2. Deterministic match state machine

   • Uses generation tokens so stale countdown/timer tasks cannot mutate a reset match.
   • Uses elapsed delta time rather than assuming loops run at exactly one second.
   • Fixes KOTH accumulation and contested/empty holder behavior.
   • Cleans up team assignment, countdown, sudden death, end/reset, FFA scoring, and callback handling.
   • Keeps unfinished Bomb/CTF code disabled until those modes receive dedicated secure implementations.

3. Authoritative combat rewrite

   • Centralizes damage, shields, fortify reduction, self-damage, friendly-fire rejection, headshots, kill attribution, score, killfeed, and objective damage.
   • Removes random critical damage.
   • Prevents double headshot multiplication.
   • Adds reload cancellation guards and weapon identity checks.
   • Provides consistent hitscan, shotgun, beam, and melee execution.
   • Makes projectile-like legacy weapons use a consistent authoritative ray path rather than fake client authority.
   • Fixes explosive self-damage and objective scoring semantics.

4. Ability runtime repairs

   • Fixes ultimates consuming charge and replaying the normal ability.
   • Processes the ActiveSlowFields collection that was previously never updated.
   • Replaces invalid gravity-well Humanoid:Move(worldPosition) usage with physical velocity pulling.

5. Versioned progression and persistence

   • Moves profiles to schema v3 with migration defaults.
   • Makes profile loading idempotent, preventing the previous duplicate load.
   • Uses UpdateAsync rather than blind SetAsync saves.
   • Prevents concurrent saves and saves during shutdown.
   • Makes leaderstats creation idempotent.
   • Removes the exploit where coin packs could be purchased using coins and grant more coins.
   • Disables battle-pass claiming until its reward/receipt path is production-ready.

6. Bot AI rebuild

   • Replaces nearest-target/random movement with perception, line-of-sight, target memory, threat scoring, retreat behavior, objective pressure, ally fallback, range management, strafing, pathfinding, aim error, reaction delays, ability usage, and ultimate usage.
   • Staggers bot updates to avoid synchronized CPU spikes.
   • Removes the broken dictionary-length path cache behavior.

7. Repository quality gates

   • Adds StyLua and Selene configuration.
   • Adds a GitHub Actions validation workflow that builds the Rojo project and checks formatting.

Deliberate product decisions

• The public mode set is limited to Standard, KOTH, and FFA.
• Bomb and CTF remain disabled because shipping insecure or logically incomplete modes would make the game worse, not more complete.
• Existing hero and weapon content remains available, but all firing now passes through one authoritative path.
• The existing UI/client foundation from PR Fix broken menu flow and rebuild responsive UI foundation #1 remains the presentation layer.

Static validation completed

• Compared the complete branch against current main.
• Confirmed nine focused commits and no branch divergence.
• Confirmed all client-requested remotes expected by ClientCore are created by the new runtime.
• Confirmed only the server decides damage, reload completion, match start, score, objective damage, profile rewards, and bot actions.
• Confirmed the new progression API preserves methods used elsewhere in the repository.
• Confirmed the new AI API preserves Init, EnableHeroAI, and Clear used by the runtime.

Required Roblox Studio verification before merge

• Rojo build succeeds and the server boots without output errors.
• Main menu -> deck selection -> confirm five unique heroes -> match countdown -> active match.
• Solo game creates the blue bot deck and all non-controlled heroes receive AI.
• Pulse Rifle, Scatter Cannon, and a sniper complete fire/reload/damage/kill loops.
• Self explosive damage works while friendly fire remains rejected.
• Generator and core damage update correctly and core destruction ends the match.
• KOTH only scores while exactly one team controls the zone.
• FFA kill limit ends the match correctly.
• Ability and ultimate activate separately; ultimate charge is consumed once.
• Time dilation and gravity well affect movement correctly.
• Rejoining/loading does not duplicate leaderstats or reset an already loaded profile.
• Mobile controls, HUD, pause/settings, scoreboard, killfeed, camera switching, and camera collision from PR Fix broken menu flow and rebuild responsive UI foundation #1 still work.
• GitHub Actions validation passes.

Important limitation

This PR performs a comprehensive static code rebuild through GitHub, but a real Roblox Studio multiplayer playtest is still required because this environment cannot execute Roblox engine physics, replication, DataStore behavior, animation playback, or device input. The PR stays draft until that live verification is completed.

[Vinay-003]

Preservation update:

The complete pre-gameplay-rebuild implementation has been preserved unchanged on branch archive/pre-gameplay-rebuild, pointing to commit 48ee5fcd91c07dc274d1ed13e41e537a8efd414c.

This archive contains the original Bomb, CTF, combat, AI, progression, runtime, and related server implementations exactly as they existed before this PR. Disabled features in the new runtime are feature-gated; their source has not been discarded and can be ported or restored line-for-line from the archive branch.

Do not delete or force-update archive/pre-gameplay-rebuild until all legacy systems have either been securely ported or intentionally retired.