Add an end-to-end TCP acceptance harness (issue #15) (#20)

Stand up the real AuthoritativeServer behind the real TCP transport on a
loopback port and drive real SyntheticProtocolClient sockets through it, so the
matrix is exercised over an actual connection rather than in-memory fakes.

Covers the baseline-protocol, TCP-compatibility, and interest-management
sections: welcome->hello->sessionReady handshake, unique/non-spoofable
server-owned ids, malformed and oversized rejection before mutation, rate-limit
tripping, transform/playerState/worldState relay, action events not
replay-cached to late joiners, disconnect/reconnect leaving no stale session,
same-cell relay vs distant interest filtering, multi-client no cross-cell spam,
and handshake-timeout reaping.

The harness runs for real wherever loopback TCP can bind (dev machines, the
self-hosted runner) and skips cleanly otherwise. Wired into a self-hosted CI
job gated by the runtime-policy guard. 60s idle-timeout, 32/64-client load /
packet-loss / reconnect-churn, and GNS sections remain follow-ups.

.github/workflows/acceptance.yml

@@ -0,0 +1,38 @@
+name: Acceptance (end-to-end TCP)
+
+# Issue #15 acceptance matrix, executed end-to-end: stands up the real
+# AuthoritativeServer behind the real TCP transport on a loopback port and drives
+# real client sockets through it. If the runner cannot bind a loopback listener,
+# the harness prints SKIP and exits 0 (it still runs for real on dev machines and
+# the NAS runner).
+
+on:
+  push:
+    paths:
+      - "server/**"
+      - ".github/workflows/acceptance.yml"
+  pull_request:
+    paths:
+      - "server/**"
+      - ".github/workflows/acceptance.yml"
+  workflow_dispatch:
+
+jobs:
+  acceptance:
+    name: End-to-end TCP acceptance
+    runs-on: [self-hosted, Linux, X64]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Enforce repository runtime policy
+        run: bash server/scripts/verify-no-legacy-runtime.sh
+
+      - uses: actions/setup-dotnet@v4
+        env:
+          DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Run end-to-end acceptance harness
+        working-directory: server
+        run: dotnet run --project acceptance/CommonwealthOnline.Server.Acceptance.csproj -c Release