Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/rank_by_byte_share.py

@@ -0,0 +1,31 @@
+"""rank_by_byte_share.py
+Rank candidates by ESTIMATED bytes leaked (delta_count * known_instance_size).
+Based on broader_vtable_sweep.py output annotated with manual size hints.
+"""
+
+# (vt, delta, est_size_bytes, label)
+TABLE = [
+    (0x00797910, 292766, 128,   "Position (quat+vec3+cache)"),
+    (0x007c78e4, 32135,  408,   "CPhysicsObj inner-vtable / CHILDLIST"),
+    (0x007c78e0, 31759,  408,   "CPhysicsObj sentinel-adj"),
+    (0x007961e0, 28413,  192,   "DBObj subclass (GraphicsObjDesc?)"),
+    (0x00799d14, 18454,  256,   "Device-related (screenshot)"),
+    (0x007ca8b0, 12107,  256,   "BSPPORTAL"),
+    (0x007c7450, 11871,  256,   "CObjectMaint-related"),
+    (0x008017c8, 10762,  256,   "D3D resource"),
+    (0x0079a690, 7689,   256,   "RenderSurface adjacent / GraphicsResource"),
+    (0x007c92a0, 7959,   192,   "SoundHook"),
+    (0x007c92b8, 7320,   192,   "SoundTweakedHook"),
+    (0x007ca4f0, 6437,   256,   "CSurface adjacent"),
+    (0x007c8948, 5925,   256,   "?"),
+    (0x007c8aa0, 5213,   256,   "?"),
+    (0x00801aa8, 4837,   256,   "D3D resource adjacent"),
+]
+
+print(f"{'vtable':12} {'delta':>8} {'size':>5} {'est_KB':>8}  label")
+total = 0
+for vt, delta, sz, label in TABLE:
+    kb = delta * sz / 1024
+    total += kb
+    print(f"0x{vt:08x} {delta:>8} {sz:>5} {kb:>8.0f}  {label}")
+print(f"{'TOTAL':>30}  {total:.0f} KB")