fix(engine): route they-may ETB choices to entrant controller - #7374

Investigator 1/3: Investigator 1 reviewed 34 assigned PRs (30 hydrated, 4 metadata-only). All hydrated patches reviewed show deep, benign Magic: The Gathering engine work with no malicious signals. Key patch-level findings: (1) PR #7341 adds match arms in crates/engine/src/game/replacement.rs for specialized CoinFlip/Damage appliers and adds regression tests in krark_thumb_coin_flip.rs and wolverine_fierce_fighter_heal.rs to prevent dead post-replacement drains. (2) PR #7259 fixes resolution-stack continuation cleanup in crates/engine/src/game/engine_resolution_choices.rs and crates/engine/src/types/resolution.rs, specifically preserving BatchDelivery frames during reveal continuation cleanup. (3) PR #7295 scopes ETB trigger suppression by source in crates/engine/src/game/triggers.rs, adding trigger_source_filter with test coverage for opponent-scoped suppression. (4) PR #7260 fixes delayed trigger target pinning in crates/engine/src/game/effects/delayed_trigger.rs and filter.rs to prevent stale tracked-set members from being affected, with unit tests. (5) PR #7263 fixes WASM JSON serialization in crates/engine-wasm/src/lib.rs by converting HashMap<ObjectId, V> to BTreeMap<String, V> for JS-boundary compatibility. No evidence of credential exfiltration, hidden network calls, obfuscated code, dependency tampering, CI tampering, permission broadening, or telemetry injection. The contributor is a MEMBER of the target repo, activity is concentrated in a single repository (phase-rs/phase) with no cross-repo bursting, and PRs reference specific Comprehensive Rules citations and issue numbers. Confidence is medium rather than high because 70 of 100 candidate PRs were omitted from hydration in the evidence packet; however, the 30 hydrated PRs include complex engine patches that strongly indicate legitimate, domain-expert development. Investigator 2/3: Investigator 2 reviewed 33 assigned pull requests from contributor matthewevans, all within the phase-rs/phase repository. Five PRs had fully-hydrated patches permitting mandatory mini-review (PRs 7337, 7258, 7265, 7264, 7290). All fully-reviewed patches contain legitimate Magic: The Gathering game engine code: regression tests for trigger ordering, engine bug fixes citing MTG Comprehensive Rules, WASM serialization improvements, parser grammar extensions, and mana-grant conditional logic. No files across the reviewed patches contain network calls, credential access, obfuscated code, dependency changes, CI tampering, or permission broadening. The contributor is a MEMBER of the phase-rs organization with activity concentrated in a single repository. One additional preview PR (7331) updates public JSON metagame feed data. The remaining 27 PRs in this shard were either preview-truncated or metadata-only and are marked unknown, but they are consistent with the same benign development profile. No suspicious signals were detected. Investigator 3/3: All 10 hydrated PRs in this shard consist of legitimate game-engine development for the phase-rs/phase Magic: The Gathering engine. Patches reviewed cover hidden-information redaction (visibility.rs), combat/targeting fixes (ability_utils.rs, combat.rs), forage trigger/parser wiring (forage.rs, oracle_trigger.rs), discard-provenance tracking, mana-permission parsing, menu queue bounding, and extensive regression tests. No network calls, credential handling, obfuscation, dependency/script changes, CI tampering, or permission broadening were observed. The contributor (author_association: MEMBER) works exclusively in this single repository (plus a personal fork). 20 PRs in this shard are metadata-only and 70 candidate PRs were omitted globally, so confidence is medium rather than high. Patch-level safety guard downgraded the result to caution: 70 PRs were metadata-only after compact hydration.