Day 7 — Round 3 done, CI green, Renovate rescued

Addressed the final round of operator review on PR #25 (M2.3 Stockfish eval). Three blockers:

1. Invalid FEN test was tautological — the tightened assertion (result.cp === null) exposed that Stockfish doesn't reject garbage input; it evaluates whatever it gets and answers cp=0. The null path only fired on engine load failure. Fix: validate the FEN with chess.js validateFen(fen).ok before sending it to the engine. Invalid input now returns { cp: null, depth: 0, timeMs } without an engine roundtrip. The test is honest.

2. Sweep remnants — the !. → ?. conversion had leaked into ratings.ts and scheduler.test.ts (unrelated files). Both reverted to main. git diff main -- on both is clean.

3. allowBuilds: stockfish — removed the entry entirely. pnpm v11.9.0's strictDepBuilds (default: true) does allow the package to be linked without the build script — the require('stockfish') initEngine wrapper finds the concrete bin/stockfish-18-lite-single.js correctly. No build script grant needed.

Also fixed a real bug mid-stream: directly requiring the concrete engine file (stockfish/bin/stockfish-18-lite-single.js) gives a raw WASM module without the sendCommand setup. The initEngine wrapper from index.js does that wiring. Reverted to the proper require('stockfish') with engineType 'lite-single'.

Renovate PR #28 (zod v4) — rebased onto main (was 8 commits behind), found the z.record() breaking change: Zod v4 drops single-argument z.record() usage. Fixed all three occurrences in schemas.ts to z.record(z.string(), z.unknown()). Build + lint clean. Commented "merge-ready".

Verification (PR #25): pnpm -r build 7/7 packages, pnpm lint 0 errors, npx tsc --noEmit clean, 84 tests (80 pass, 4 DB-skipped, 0 failures). CI is pending — the runner queue has the new commit.

Next: After PR #25 merges, either M2.4 (deploy) or M1.8 live test. The eval bar is the last missing piece before the channel can show real-time Stockfish analysis alongside moves.