Ambushed teleports carry their destination; room 59UN unstuck (rev 35)

An ambush springing TELEPORT OPPONENT opened a stack with params null —
the spring bypasses cast validation and nothing ever asked where the
victim goes — and resolution crashed on the missing cell, wedging the
room 'waiting on Automaton'. Three layers:
- Crash guards: teleport-opponent and mental-force fizzle gracefully on
  a destination-less stack (ungated: no stored command had resolved one).
- The trap commits its destination when laid: setAmbush carries a cell
  ('wherever you say', said in advance), the spring passes it into the
  stack, and the client's arming flow asks for the click.
- Rev 35 refuses arming those spells without a destination; older
  ledgers armed blind and their springs fizzle.
All ledgers verified before deploy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138A8CjeQRpvzKxuMfz1Bqc

packages/web/src/local.svelte.ts

@@ -136,7 +136,7 @@ class LocalGame {
       seed,
       sets: expansion ? ["basic", "expansion1"] : ["basic"],
       ...(colors ? { colors } : {}),
-      deckRev: 34,
+      deckRev: 35,
     };
     const { state, events } = createGame(config);
     for (const e of events) {