Own scene lifetimes and shootable presentation

[alowpoly]

Map loading, scene state and shootable rendering now have explicit owners. Scene consumers share one live view of the current scene, collision world, entity index and pivot. Collision is validated before disposing the previous scene, so a malformed map leaves the current map intact.

Shootable presentation owns mesh handles, active frames, frame pools and DOM updates separately from enemy simulation state. Combat and death handling query residency through that owner. Existing targeting rules, attack cancellation, animation cadence and prewarm policies are preserved. Repeated acquisition/removal cannot orphan or double-remove handles; failed frame replacement retains the current handle.

Map-load completion and failure retain ownership across asynchronous callers, preventing stale requests from publishing routes, restoring saves or resuming controls. Failed stylesheet, image and frame-bank requests leave their caches so they can be retried. TypeScript 5.9.3 is pinned; CI rejects diagnostics beyond the existing baseline of 174.

Validation:

• Typecheck and build pass. Without prepared assets: 357 contracts pass, 3 skip. With assets: 359 pass; the existing multiplayer map-definition count test fails as it does on the base commit.
• 36 deterministic controller scenarios match the base commit across 648 checkpoints, including gameplay state, ordered events and mesh lifetime.
• 17 headless browser scenarios and all 6 URL/API smoke checks pass. The existing logical-targetability fixture still fails at focusEntity, target 100, on both versions.
• Matched headless E1M5 traces preserve geometry and handle churn. Scripting cost does not increase; the worst-frame result is inconclusive because one candidate capture has an image-decoding spike.

Full rollback after disposal begins, cache size limits and desktop pointer-lock validation remain outside the coverage of this change.