Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bin/cdb_probe.ps1

@@ -0,0 +1,51 @@
+#requires -Version 5.1
+<#
+    cdb_probe.ps1 <dump.dmp>
+    Standard analysis probe for an acclient minidump. Writes structured
+    output next to the dump as <dump>.probe.txt.
+
+    Runs (in order):
+      vertarget        — image version + uptime
+      .lastevent       — last debug event captured
+      !peb             — process env block
+      lm vM            — modules with versions
+      !address -summary — VA usage summary
+      !address /f:Heap — list heap regions and sizes
+      !runaway 7       — thread CPU usage (kernel+user time)
+      ~* k 12          — short stack of every thread (no symbols, just RVAs)
+#>
+
+param(
+    [Parameter(Mandatory)] [string] $Dump
+)
+
+$ErrorActionPreference = 'Stop'
+if (-not (Test-Path $Dump)) { throw "Dump file not found: $Dump" }
+
+$cdb = 'C:\Users\acbot\Tools\WindowsKits\Windows Kits\10\Debuggers\x86\cdb.exe'
+$out = "$Dump.probe.txt"
+$env:_NT_SYMBOL_PATH = 'C:\Users\acbot\leakhunt\pdb'
+
+$script = @(
+    '.echo === vertarget ==='
+    'vertarget'
+    '.echo === lastevent ==='
+    '.lastevent'
+    '.echo === peb ==='
+    '!peb'
+    '.echo === modules ==='
+    'lm vM'
+    '.echo === address summary ==='
+    '!address -summary'
+    '.echo === heap regions ==='
+    '!address /f:Heap'
+    '.echo === runaway ==='
+    '!runaway 7'
+    '.echo === threads top frames ==='
+    '~* k 12'
+    'q'
+) -join ';'
+
+& $cdb -z $Dump -y 'C:\Users\acbot\leakhunt\pdb' -c $script 2>&1 |
+    Out-File -FilePath $out -Encoding utf8
+Write-Output "probe written: $out  size=$([math]::Round((Get-Item $out).Length/1KB,1)) KB"