Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

templates/login.ahk

@@ -0,0 +1,52 @@
+; AutoHotkey v2 — login skeleton for retail acclient.exe
+;
+; Drives the launcher login screen. Fills in test credentials, clicks
+; through character select. Adjust ImageSearch / Click coordinates after
+; first manual run — UI layouts depend on resolution and skin.
+;
+; Usage: launch this after supervisor.ps1 starts acclient.exe
+
+#Requires AutoHotkey v2.0
+#SingleInstance Force
+
+; --- config ---
+USERNAME := "testaccount"
+PASSWORD := "testpassword"
+CHAR_SLOT := 1
+WAIT_TIMEOUT_S := 60
+; --- end config ---
+
+WinTitle := "Asheron's Call"
+
+; Wait for the AC window
+if not WinWait(WinTitle, , WAIT_TIMEOUT_S) {
+    MsgBox "AC window not found within " WAIT_TIMEOUT_S "s — aborting"
+    ExitApp 1
+}
+WinActivate WinTitle
+Sleep 2000
+
+; Type username
+Send USERNAME
+Send "{Tab}"
+Send PASSWORD
+Send "{Enter}"
+
+; Wait for character select screen — adjust the wait for your skin
+Sleep 8000
+
+; Select character (slot 1 is top of list)
+Loop CHAR_SLOT - 1 {
+    Send "{Down}"
+    Sleep 200
+}
+Send "{Enter}"
+
+; Wait for in-world load
+Sleep 15000
+
+; If you got here, you're in-world.
+; The supervisor doesn't need anything else from us; the controller DLL
+; (Phase 3) drives in-game activity.
+
+ExitApp 0