Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dll/leakfix/build.bat

@@ -0,0 +1,34 @@
+@echo off
+setlocal
+pushd "%~dp0"
+
+set "VCVARS=C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvars32.bat"
+if not exist "%VCVARS%" (
+  echo ERROR: vcvars32.bat not found at "%VCVARS%"
+  exit /b 1
+)
+
+call "%VCVARS%" >nul
+
+if not exist build mkdir build
+
+cl /LD /nologo /O2 /MT /EHsc /std:c++17 /W3 ^
+   /D_CRT_SECURE_NO_WARNINGS /D_WIN32_WINNT=0x0601 ^
+   /Fo"build\\" /Fd"build\\" ^
+   /Fe"build\leakfix.dll" ^
+   src\dllmain.cpp src\patches.cpp src\thunks.cpp src\logging.cpp src\instr.cpp ^
+   /link /SUBSYSTEM:WINDOWS kernel32.lib user32.lib dbghelp.lib /OUT:"build\leakfix.dll"
+set RC=%ERRORLEVEL%
+
+if %RC% NEQ 0 (
+  echo BUILD FAILED rc=%RC%
+  popd
+  exit /b %RC%
+)
+
+echo.
+echo Built: %CD%\build\leakfix.dll
+echo.
+
+popd
+endlocal