Add the engine core: path-addressed state, data-driven turns

The planning docs commit to one thing above all: adding content must never
require touching the engine. This lays the foundation that makes that true.

All game state is addressable by dotted path (money, skills.negotiation,
relationships.boss.likes_you, flags.took_loan), and conditions and effects are
generic operations over those paths. The schema in the planning docs had
`requires: { skill, min }` and `effects: { money, skills, relationships }`,
both of which hardcode the state shape into the engine; the first gate wanting
a relationship threshold or a flag would have meant an engine change.

There is deliberately no "random event" category. Every turn filters the whole
event pool by stage and conditions and draws by weight, so a routine turn, a
rare interruption and the hard-times branch differ only in their data.

Also here, neither in the planning docs but both cheap and load-bearing:

- A seeded, serializable RNG. Runs replay exactly from seed plus choices, which
  makes tests deterministic and playtest reports reproducible. The generator's
  position is one uint32 living in the save.
- A load-time content validator. Undeclared paths, unknown character ids, ids
  that cannot be path segments, events that can never fire and stages with no
  fallback event are all caught on load instead of forty turns into a game.

The turn loop is a pure function, so a saved game resumes into exactly the run
it left — covered by a test that plays thirty turns, plays the same thirty with
a JSON round trip in the middle, and deep-equals the two.

72 tests, no dependencies. Reasoning recorded in docs/DECISIONS.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMSFHyVPitUoosW5wyEADj

test/paths.test.js

@@ -0,0 +1,47 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { getPath, setPath, hasPath, parsePath, listPaths } from '../src/engine/paths.js';
+
+const state = { money: 100, skills: { talking: 2 }, relationships: { chief: { likes_you: 50 } } };
+
+test('reads nested paths', () => {
+  assert.equal(getPath(state, 'money'), 100);
+  assert.equal(getPath(state, 'skills.talking'), 2);
+  assert.equal(getPath(state, 'relationships.chief.likes_you'), 50);
+});
+
+test('missing paths read as undefined, not as a throw', () => {
+  assert.equal(getPath(state, 'skills.welding'), undefined);
+  assert.equal(getPath(state, 'nothing.at.all'), undefined);
+  assert.equal(hasPath(state, 'skills.welding'), false);
+  assert.equal(hasPath(state, 'skills.talking'), true);
+});
+
+test('writes without mutating the original', () => {
+  const next = setPath(state, 'skills.talking', 5);
+  assert.equal(next.skills.talking, 5);
+  assert.equal(state.skills.talking, 2, 'original state must be untouched');
+  assert.equal(next.relationships, state.relationships, 'untouched branches are shared');
+});
+
+test('creates missing intermediate objects', () => {
+  const next = setPath({}, 'flags.deep.nested', true);
+  assert.equal(next.flags.deep.nested, true);
+});
+
+test('rejects prototype-polluting paths', () => {
+  assert.throws(() => parsePath('__proto__.polluted'), /forbidden/);
+  assert.throws(() => parsePath('constructor'), /forbidden/);
+  assert.throws(() => setPath({}, 'a.prototype.b', 1), /forbidden/);
+});
+
+test('rejects malformed paths', () => {
+  assert.throws(() => parsePath(''), /non-empty/);
+  assert.throws(() => parsePath('money.'), /invalid path segment/);
+  assert.throws(() => parsePath('a b'), /invalid path segment/);
+  assert.throws(() => parsePath(42), /non-empty string/);
+});
+
+test('lists leaf paths', () => {
+  assert.deepEqual(listPaths(state), ['money', 'skills.talking', 'relationships.chief.likes_you']);
+});