fix(client): address PR #4 review feedback

Hoshe critical fixes:
- _action_enum_to_wire uses InputMapper.Action constants instead of
  fragile integer literals; OPEN_MENU explicitly handled as client-only
- Remove int() coercion on tick/entity_id — use direct assignment since
  GDScript int is signed 64-bit (safe for realistic tick values)
- Check encode result before buffering in send_input() — reject empty
  bytes instead of corrupting the outbound stream
- Test snapshot now uses Protocol format {tick, entities} instead of
  legacy schema; GameState updated to derive player position from
  entity data; main.gd and world_renderer.gd updated accordingly

Hoshe warnings:
- 5 negative tests added (truncated bytes, wrong type, missing fields,
  empty bytes, encode validation) — 20/20 tests pass
- receive_bytes signal is emitted at consume time in poll_snapshot by
  design (documented in code)

Tyre suggestions:
- Remove duplicated root-level fixtures — single source of truth in
  client/tests/fixtures/msgpack/
- gen_fixtures.rs writes directly to client/ directory
- Add `make fixtures` target for regeneration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

client/tests/test_protocol.gd

@@ -135,3 +135,36 @@ func test_gdscript_encode_matches_rust_fixture() -> void:
 	assert_that(from_gd.tick).is_equal(from_rust.tick)
 	assert_that(from_gd.action.variant).is_equal(from_rust.action.variant)
 	assert_that(from_gd.action.data).is_equal(from_rust.action.data)
+
+
+# -- Negative tests: malformed/truncated input -----------------------------------
+
+func test_decode_snapshot_truncated_bytes() -> void:
+	var truncated := PackedByteArray([0x82, 0xa4])  # Incomplete msgpack map
+	var result = Protocol.decode_snapshot(truncated)
+	assert_that(result).is_null()
+
+
+func test_decode_snapshot_wrong_type() -> void:
+	# Encode an array instead of a map — should fail validation
+	var encoded = Messagepack.encode([1, 2, 3])
+	var result = Protocol.decode_snapshot(encoded.value)
+	assert_that(result).is_null()
+
+
+func test_decode_snapshot_missing_fields() -> void:
+	# Map with wrong keys
+	var encoded = Messagepack.encode({"foo": "bar"})
+	var result = Protocol.decode_snapshot(encoded.value)
+	assert_that(result).is_null()
+
+
+func test_decode_player_input_empty_bytes() -> void:
+	var result = Protocol.decode_player_input(PackedByteArray())
+	assert_that(result).is_null()
+
+
+func test_encode_returns_empty_on_failure() -> void:
+	# Verify that a valid encode produces non-empty bytes
+	var bytes = Protocol.encode_player_input(1, "MoveNorth")
+	assert_that(bytes.size()).is_greater(0)