Fix engine lifecycle and CI sandboxing

[jr4488]

Summary

• restore captured pieces' original movement state when engine search moves are undone
• pass completed plies consistently and enforce quiet/game draw horizons inside quiescence search
• cancel in-flight guided-play searches on pause, reset, expiry, and session end without letting an older search clear a newer busy state
• discard and recreate workers after error events or synchronous postMessage failures
• load Ubuntu 24.04's targeted Bubblewrap AppArmor profile in CI and emit bounded sandbox diagnostics on failure
• make the Codex-provider tests portable and tolerate expected connection resets during forced server shutdown
• add focused regression coverage for engine round trips, draw boundaries, worker recovery, and guided-play lifecycle races

Why

Search undo records lost captured-piece state, game-ply accounting was one move ahead, quiescence could search beyond draw limits, and guided-play cancellation left stale worker or UI state. GitHub's Ubuntu 24.04 runners also restrict unprivileged user namespaces through AppArmor, causing the mandatory Bubblewrap integration smoke test to fail before the rest of CI could complete.

Impact

Engine searches now leave positions unchanged, choose moves against the correct game horizon, and recover cleanly from cancellation or worker failure. The CI sandbox remains mandatory while using a targeted AppArmor allowance instead of disabling the host-wide user-namespace restriction.

Validation

• npm run verify
  • 36 test files passed
  • 444 tests passed, 2 expected platform skips
  • coverage: 89.45% statements, 83.12% branches, 93.68% functions, 90.91% lines
  • ESLint passed
  • production build passed
  • production dependency audit passed
• npm audit --audit-level=high — 0 vulnerabilities
• git diff --check passed
• workflow YAML parsed successfully

Follow-up

The updated AppArmor setup still needs confirmation from this PR's GitHub-hosted Ubuntu matrix.