feat(engine): publish and validate a bounded loop shortcut's own declaration - #7375

Scan completed for PR #7375 (beff50c).

Areas examined:

1. CI/CD changes — No GitHub Actions workflow files are present in this PR. The only build-orchestration change is the Tiltfile, which adds a local probe-pin-census resource running cargo build and a project-local probe-pin check binary against a checked-in manifest. No secrets, untrusted interpolations, network calls, or mutable action references were found.

2. Lifecycle events — No package-manager lifecycle hooks were modified. The PR does not touch Cargo.toml, build.rs, package.json, Docker entrypoints, git hooks, or any other install/build/test/release startup path.

3. Malicious intent — Reviewed for secret exfiltration, obfuscation, encoded payloads, unexpected network calls, dependency confusion, privilege escalation, credential handling, telemetry leaks, suspicious binary additions, and dangerous eval/exec patterns. None were found. The PR is a substantial feature addition (bounded-loop-shortcut declaration and validation) accompanied by defensive hardening: payload-size bounds in game_action_payload_guard.rs, hidden-information redaction in visibility.rs, RNG-state consistency fixes in session.rs and engine-wasm, and stack-budget ceiling corrections in game_state_size.rs. All protocol version bumps (v30→31, wire v20→21) are consistent across client and server and are extensively documented.

4. Skill mutations — skill-targets.json is empty; no skill target directories to scan.