Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bin/admin_uac_silent.ps1

@@ -0,0 +1,27 @@
+#requires -Version 5.1
+<#
+    admin_uac_silent.ps1 — sets ConsentPromptBehaviorAdmin = 0 so future
+    elevations from this admin user happen silently. Reversible via the
+    same key (default value = 5).
+#>
+$ErrorActionPreference = 'Continue'
+$log = 'C:\Users\acbot\leakhunt\artifacts\soak\admin_uac.log'
+Start-Transcript -Path $log -Force | Out-Null
+try {
+    if (-not ([Security.Principal.WindowsPrincipal]::new(
+        [Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole(
+        [Security.Principal.WindowsBuiltInRole]::Administrator)) {
+        Write-Host 'ERROR: not elevated.' -ForegroundColor Red
+        exit 1
+    }
+    $k = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'
+    $before = (Get-ItemProperty -Path $k -Name ConsentPromptBehaviorAdmin -ErrorAction SilentlyContinue).ConsentPromptBehaviorAdmin
+    Write-Host ("ConsentPromptBehaviorAdmin BEFORE = {0}" -f $before)
+    Set-ItemProperty -Path $k -Name ConsentPromptBehaviorAdmin -Value 0 -Type DWord -Force
+    $after = (Get-ItemProperty -Path $k -Name ConsentPromptBehaviorAdmin).ConsentPromptBehaviorAdmin
+    Write-Host ("ConsentPromptBehaviorAdmin AFTER  = {0}" -f $after) -ForegroundColor Green
+} catch {
+    Write-Host "FATAL: $($_ | Out-String)" -ForegroundColor Red
+}
+Stop-Transcript | Out-Null
+Read-Host 'press enter to close'