fix #436: combat no-target refusal reaches the SpewBox with retail's exact text

Attacking with no valid target has told the player nothing since Campaign V
slice V11 orphaned the DebugVM toast the message was wired to (#434 found
the drop; this closes it retail-faithfully).

Ground truth from the Ghidra decompile of
ClientCombatSystem::ExecuteAttack (0x0056bb70): retail writes
"You must select a valid combat target before attacking" via
ClientSystem::AddTextToScroll(..., 0x1A, true, 0) — the ClientLocal
SpewBox channel this codebase already routes every other client-local
refusal through. And retail has ONE message, not the two we carried:
attacking outside melee/missile modes is silent (ExecuteAttack is
unreachable there), so the invented "Enter melee or missile combat first"
text is deleted rather than rerouted, and the invented "No monster
target" is replaced by the retail string, which joins ClientTextRefusals
with its decomp citation.

Wiring: CombatFeedbackSlot gains the sibling BindOwned session-lifetime
shape, and SessionPlayerComposition.CompleteSessionPlayer binds it to
RuntimeCommunicationState.AddText(ClientLocal) with session-owned
teardown — a torn-down session's slot returns to its silent unbound
state. A binding-seam test
(CompleteSessionPlayerBindsCombatFeedbackToTheClientLocalSpewBoxRoute)
inspects the compiled composition for the BindOwned call and its
AddText-routing lambda, so the slot can never again pass its unit tests
while production leaves it unbound — the exact failure mode that hid
this defect. The two tests that pinned the invented strings now pin the
retail contract (exact string; silence for the unsupported-mode case).

Full hermetic suite 15,325 passed / 0 failed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.App.Tests/Composition/SessionPlayerCompositionTests.cs

@@ -106,6 +106,38 @@ public sealed class SessionPlayerCompositionTests
             field => field.FieldType == typeof(GameWindow));
     }
 
+    [Fact]
+    public void CompleteSessionPlayerBindsCombatFeedbackToTheClientLocalSpewBoxRoute()
+    {
+        // #436 binding-seam check (a slot can pass its own unit tests while
+        // nothing in production binds it — that is exactly how the combat
+        // refusals were silently dropped for months): CompleteSessionPlayer
+        // must session-own a CombatFeedbackSlot.BindOwned whose target lambda
+        // routes to RuntimeCommunicationState.AddText (the ClientLocal
+        // SpewBox chokepoint; retail ClientCombatSystem::ExecuteAttack
+        // 0x0056bb70 -> AddTextToScroll(0x1A)).
+        MethodInfo complete = RequiredMethod(
+            typeof(SessionPlayerCompositionPhase),
+            "CompleteSessionPlayer");
+        Assert.Contains(
+            CompiledCallGraph.Read(complete),
+            call => call.Target.DeclaringType
+                    == typeof(AcDream.App.Combat.CombatFeedbackSlot)
+                && call.Target.Name
+                    == nameof(AcDream.App.Combat.CombatFeedbackSlot.BindOwned));
+
+        IEnumerable<MethodBase> lambdas =
+            CompiledCallGraph.ReadMethodReferences(complete)
+                .Select(call => call.Target)
+                .Where(method => method.GetMethodBody() is not null);
+        Assert.Contains(
+            lambdas,
+            method => CompiledCallGraph.Read(method).Any(call =>
+                call.Target.DeclaringType
+                    == typeof(AcDream.Runtime.Gameplay.RuntimeCommunicationState)
+                && call.Target.Name == "AddText"));
+    }
+
     [Fact]
     public void ProductionPhaseStartsStreamerBeforeSessionAndTransfersPortalLast()
     {