Ship-audit P0/P1 sweep on open5e: prose, combat math, UX hygiene

P0 — actual bugs:
- eldritch_blast: SRD-imported "Whatever" placeholder leaked to players;
  overlay added in dnd_spells_data.go.
- Battle Master disarming_attack + parry: math.Max on multiplicative
  DamageReduct was a no-op vs the 1.0 default. Switched to *= and added
  regression tests covering the stacking case too.
- Extended TestSpellDescriptionsAreJargonFree to catch "Whatever",
  trailing ellipses, mid-word truncation, and empty-size phrases. This
  surfaced 4 more genuinely-broken SRD descriptions (find_familiar,
  clairvoyance, glyph_of_warding, teleportation_circle); all now
  overlayed in dnd_spells_data.go.

P1 — UX hygiene:
- Setup completion now nudges new casters toward !spells/!cast.
- Magic-item attunement vocab unified to "bond" everywhere user-facing;
  renamed the Treasures sheet section to avoid clashing with the bond
  vocab.
- Ambient DM footers stripped of "Threat +N" / "Supplies −N SU" hidden-
  meter leakage; verb-form footers instead.
- !expedition status defaults to a days-left + threat-label summary;
  raw SU / threat-out-of-100 / zone-stack / roll-modifier moved behind
  `!expedition status --debug`.
- !zone taunt/compliment help text dropped the "(mood −10)" / "(mood +5)"
  numerics that turned the hidden TwinBee-mood mechanic into a min/max
  knob.
- TwinBee pronoun pass: switched she/her to singular they on the two
  surfaces I touched plus achievements.bj_beat_twinbee.

P1 — correctness/scale:
- adventure_shop curio purchase now guards the euro.Debit bool return
  before inventory grant + pot cut; the GetBalance preflight isn't
  enough since a concurrent blackjack/lottery debit can slip the balance
  across BLACKJACK_DEBT_LIMIT between read and write.
- equipMagicItem reordered: remove inventory item BEFORE equip, with a
  best-effort rollback if equip fails. The prior order left a dup
  window if the inventory delete tripped on a transient DB error.
- magicItemsByRarityCache promoted to sync.Once — concurrent cold-start
  loot rolls otherwise raced on the lazy assignment.

Stale-audit verifications (no code change needed):
- light / druidcraft / water_walk overlays already exist and win the
  SRD merge — the broken raw text never reaches players.
- bootstrapPhase5BHPRefresh is already wired at adventure.go:228.

Deferred:
- combatantsForSession per-turn 6-load DB chatter (perf P1-A): touches
  the hot combat path; needs its own test pass before shipping. Tracked
  in memory at project_combat_session_cache_deferred.

go vet clean; go test -race ./... green (229s).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/plugin/expedition_ambient.go

@@ -311,12 +311,13 @@ func (p *AdventurePlugin) applyAmbientEffect(e *Expedition, ev ambientEvent) str
 		if err := applyThreatDelta(e.ID, 1, "ambient: distant noise"); err != nil {
 			slog.Warn("expedition: ambient threat delta", "expedition", e.ID, "err", err)
 		}
-		return "Threat +1"
+		// Verb-form footer — "Threat +N" exposed the hidden meter.
+		return "The dungeon listens a little harder."
 	case "faction_whisper":
 		if err := applyThreatDelta(e.ID, 2, "ambient: faction whisper"); err != nil {
 			slog.Warn("expedition: ambient threat delta", "expedition", e.ID, "err", err)
 		}
-		return "Threat +2"
+		return "Something out there is paying attention now."
 	case "pack_rat":
 		drain := float32(0.2) + float32(rng.IntN(2))*float32(0.1) // 0.2 or 0.3
 		ns := e.Supplies
@@ -328,7 +329,10 @@ func (p *AdventurePlugin) applyAmbientEffect(e *Expedition, ev ambientEvent) str
 			slog.Warn("expedition: ambient supply drain", "expedition", e.ID, "err", err)
 			return ""
 		}
-		return fmt.Sprintf("Supplies −%.1f SU", drain)
+		// Don't surface the raw SU number — it's a hidden meter and
+		// "SU" doesn't appear in player vocab anywhere else.
+		_ = drain
+		return "A little less in the pack than there was."
 	case "lucky_find":
 		coins := 1 + rng.IntN(4) // 1d4
 		if p.euro != nil {