Harden /ask helper, UDP replies and run_lua in multiplayer

- Pass the /ask question to claude on stdin so it can't be parsed as a CLI option.
- Block run_lua in multiplayer unless an admin enables the new
  "Allow Lua queries in multiplayer" map setting.
- Ignore UDP packets that don't come from the game's port, in both the
  MCP server and the ask helper.
- Build the screenshot path from our own name instead of the game's reply,
  and restrict screenshot names in the mod.
- Validate ask packets, cap question length and limit concurrent claude runs.
- Replace hard-coded home paths in the README and systemd unit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/claude_co_engineer/game_link.py

@@ -18,7 +18,9 @@ class _Protocol(asyncio.DatagramProtocol):
         self.link = link
 
     def datagram_received(self, data: bytes, addr: Any) -> None:
-        self.link._on_packet(data)
+        # The game replies from its --enable-lua-udp port; ignore anything else on localhost.
+        if addr[:2] == self.link.peer:
+            self.link._on_packet(data)
 
 
 class GameLink:
@@ -39,6 +41,8 @@ class GameLink:
     async def _ensure_open(self) -> asyncio.DatagramTransport:
         if self._transport is None or self._transport.is_closing():
             loop = asyncio.get_running_loop()
+            # The address replies come from, resolved so a hostname like "localhost" matches.
+            self.peer = (socket.gethostbyname(self.host), self.game_addr[1])
             sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
             # Large replies arrive as a burst of ~32KB packets; give the kernel room to queue them.
             sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 8 * 1024 * 1024)