fix(sim): cap crash point so extreme seeds cannot overflow or bankrupt

At u=1 the unsigned quotient exceeded int64 and wrapped negative, so the
rarest and most valuable outcome silently became an instant 1.00x loss.
At u=2 it produced a 2.1-billion-times payout the house could never
cover, which would have left settlement failing and the player unpaid.
The crash point is now capped at the largest multiplier the curve can
express, which is unreachable anyway since the round hits its tick
ceiling first.

FromInt now panics outside the Q32.32 integer range instead of wrapping
a positive input into a negative value.

Raises coverage to 88% overall; adds a Makefile with db-reset, since the
append-only ledger steadily consumes bridge headroom across test runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pkg/fixed/fixed.go

@@ -19,8 +19,24 @@ const One F = 1 << 32
 
 const fracBits = 32
 
+// MaxInt is the largest whole number representable in Q32.32. Values beyond
+// it cannot be held in the 32 integer bits.
+const MaxInt int64 = 1<<31 - 1
+
+// MinInt is the smallest whole number representable in Q32.32.
+const MinInt int64 = -(1 << 31)
+
 // FromInt converts a whole number to fixed-point.
-func FromInt(v int64) F { return F(v << fracBits) }
+//
+// It panics outside [MinInt, MaxInt] rather than wrapping. A silent wrap here
+// produced a negative multiplier from a positive input, which is exactly the
+// kind of fault that is invisible until it corrupts a payout.
+func FromInt(v int64) F {
+	if v > MaxInt || v < MinInt {
+		panic("fixed: " + strconv.FormatInt(v, 10) + " is outside the Q32.32 integer range")
+	}
+	return F(v << fracBits)
+}
 
 // Int truncates toward negative infinity and returns the whole part.
 func (a F) Int() int64 { return int64(a) >> fracBits }