Fix id-namespace regression, add StrikeRequest type, kill full-panel

rerender on assign/alive/shell, add Windows build tooling

- Board.add_target/add_ally's id auto-assignment used a bare
  next(c for c in string.ascii_uppercase if c not in used), which
  raises StopIteration once 26 entities of a group exist -- a real
  crash confirmed via a live traceback, and a direct regression from
  moving that sequence from per-type to per-group. This was the actual
  cause of "Accept as"/"Accept all" silently doing nothing. Fixed with
  _next_free_id(), which rolls over to two-letter ids instead of
  raising.
- New TargetType.STRIKE_REQUEST: the bearing/distance-offset "taking
  fire" fire-support request (see the earlier two-entity split) now
  creates this instead of reusing STRIKE, so a radioed-in request is
  never confused with a strike the player placed themselves. Same
  crosshair icon, excluded from type pickers/dedupe like STRIKE.
- The "Accept as..." popover on a detected map marker now uses the
  same icon grid the entity-edit "Change type" popover does (was a
  plain unfiltered text list of every TargetType, which also wrongly
  offered STRIKE/STRIKE_REQUEST as pickable).
- Firing panel: _cycle_assignment/_toggle_alive/_pick_shell no longer
  route through app.py's full solver+dedupe+canvas+panel refresh --
  none of the three can affect the solver or dedupe, and none change
  which cards exist or their order (except _toggle_alive in
  hide/sort_later mode). New FiringPanel._rebuild_one() rebuilds just
  the one changed card; on_visual_change is a new, lighter callback
  (just a map redraw) for the two of these three that actually affect
  it. This was a real, confirmed lag source with many units on the
  board: every click on any of these was previously rebuilding every
  card of every target.
- Map right-click entity menu: added "Mark destroyed"/"Mark alive",
  reusing the same cheap-refresh path (new
  FiringPanel.refresh_after_alive_change).
- packaging/windows/: a from-scratch (untested against a real boot)
  MSYS2 + WiX .msi build pipeline for Windows, driven from Linux via
  dockur/windows (KVM-in-container), no Windows machine or GitHub
  required. See its own README for status/caveats.
- New/updated tests: id-namespace sharing + the 26-entity overflow
  regression (tests/test_models.py), StrikeRequest split
  (tests/test_ocr.py), warp_to_map's img_scale param
  (tests/test_map_vision_warp.py). 44/44 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packaging/windows/build_windows.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Build a Windows .msi for FEnigma, entirely on this Linux host, no
+# Windows machine or GitHub required: boots a real Windows VM inside a
+# container (dockur/windows, QEMU+KVM), provisions it once (MSYS2 +
+# GTK4/libadwaita/PyGObject + WiX, see oem/install.bat), then drives every
+# build over a shared folder -- drop a request, wait for the .msi to show
+# up.
+#
+# UNTESTED end to end (no KVM/Windows available in the environment this
+# was written in) -- expect to debug oem/*.bat and product.wxs against a
+# real run. Watch the first boot/install at http://localhost:8006 (noVNC)
+# to see what's actually happening; it also has RDP on :3389 if you'd
+# rather use a real RDP client.
+#
+# First run: full unattended Windows install + provisioning, likely
+# 30-90 minutes. Every run after that: just boot + build, a few minutes.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+REPO_ROOT="$(cd .. && cd .. && pwd)"
+VERSION="${1:-0.1.0}"
+TIMEOUT_S="${BUILD_TIMEOUT_S:-7200}"  # generous: covers a from-scratch first run
+OUT_DIR="${REPO_ROOT}/dist-windows"
+
+if [ ! -e /dev/kvm ]; then
+    echo "No /dev/kvm -- dockur/windows needs KVM (check virtualization is" >&2
+    echo "enabled and your user is in the 'kvm' group: groups | grep kvm)." >&2
+    exit 1
+fi
+command -v docker >/dev/null 2>&1 || { echo "docker not found." >&2; exit 1; }
+
+mkdir -p storage oem shared/src shared/dist "$OUT_DIR"
+
+echo "==> starting the Windows build VM (docker compose up -d)"
+docker compose up -d
+
+echo "==> syncing FEnigma source into the VM's shared folder"
+rm -rf shared/src
+mkdir -p shared/src
+cp -r "${REPO_ROOT}/src" shared/src/
+echo "$VERSION" > shared/BUILD_VERSION
+rm -f shared/BUILD_DONE shared/BUILD_FAILED
+rm -rf shared/dist
+mkdir -p shared/dist
+
+echo "==> requesting a build (version $VERSION)"
+touch shared/BUILD_REQUEST
+
+echo "==> waiting for it (up to ${TIMEOUT_S}s -- first run is slow, see"
+echo "    this script's own header comment; watch http://localhost:8006"
+echo "    if you want to see what's actually happening)"
+elapsed=0
+while [ ! -e shared/BUILD_DONE ] && [ ! -e shared/BUILD_FAILED ]; do
+    if [ "$elapsed" -ge "$TIMEOUT_S" ]; then
+        echo "Timed out after ${TIMEOUT_S}s waiting for the build." >&2
+        echo "Check the VM directly (http://localhost:8006) -- it may still" >&2
+        echo "be mid Windows-install, or oem/install.bat may have wedged." >&2
+        exit 1
+    fi
+    sleep 10
+    elapsed=$((elapsed + 10))
+    printf '.'
+done
+echo
+
+if [ -e shared/BUILD_FAILED ]; then
+    echo "==> build FAILED. Log:" >&2
+    cat shared/dist/build.log 2>/dev/null || cat shared/build.log.failed 2>/dev/null || true
+    exit 1
+fi
+
+msi="$(find shared/dist -maxdepth 1 -name '*.msi' | head -n1)"
+if [ -z "$msi" ]; then
+    echo "BUILD_DONE appeared but no .msi found in shared/dist -- see" >&2
+    echo "shared/dist/build.log" >&2
+    exit 1
+fi
+
+cp "$msi" "$OUT_DIR/"
+echo "==> done: $OUT_DIR/$(basename "$msi")"