Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

templates/activity-phases.json

@@ -0,0 +1,46 @@
+{
+  "phases": [
+    {
+      "name": "idle",
+      "duration_min": 60,
+      "description": "Sit at lifestone. No input. Establishes baseline allocator noise.",
+      "actions": []
+    },
+    {
+      "name": "wander",
+      "duration_min": 60,
+      "description": "Walk a fixed route around Holtburg town. Targets streaming + landblock loads.",
+      "actions": [
+        { "type": "walk_route", "waypoints": ["lifestone", "town-square", "marketplace", "south-gate", "lifestone"], "loop": true }
+      ]
+    },
+    {
+      "name": "chat",
+      "duration_min": 60,
+      "description": "Spam /say and /tell. Targets chat-log buffers.",
+      "actions": [
+        { "type": "send_chat", "channel": "say", "message_template": "test {counter}", "interval_sec": 2 }
+      ]
+    },
+    {
+      "name": "target-cycle",
+      "duration_min": 60,
+      "description": "Tab through nearby targetables. No combat. Targets selection + tooltip allocation.",
+      "actions": [
+        { "type": "press_key", "key": "Tab", "interval_sec": 3 }
+      ]
+    },
+    {
+      "name": "ui-cycle",
+      "duration_min": 60,
+      "description": "Open/close inventory, character pane, spells pane. Targets UI-widget allocation.",
+      "actions": [
+        { "type": "press_key", "key": "i", "interval_sec": 5 },
+        { "type": "press_key", "key": "c", "interval_sec": 7 },
+        { "type": "press_key", "key": "s", "interval_sec": 9 }
+      ]
+    }
+  ],
+  "snapshot_interval_min": 15,
+  "notes": "Phase 2 schedule. Run one phase per session, fresh from bench-verified snapshot. Compare growth rates across phases to localize the leak's subsystem."
+}