Integrate Riftbound audit fixes and enforce constructed deck bans

[abueide]

Summary

• Bump Kai to 0.21.3 and pin Agni to aggregate 1726c7ee59b5eb91e0ea473e539a4c7ca6234d0e, containing the four independently reviewable audit fixes.
• Recompute current Riftbound legality instead of trusting a stale draft report.
• Check registered decks before editor seating, normal deck/reload/battlefield sends, and AI/CLI deal sends when the table is marked rules-enforced.
• Reject banned main/champion/sideboard cards through Agni's shared validator. Keep historical imports intact and preserve explicitly confirmed free-table seating.
• Retain all three Stacked Deck copies in the historical Kha fixture and expect its current-policy Banned/Broken finding.

Upstream dependencies — keep draft until coordinated

• Fix Zed swap's unprinted exhaust cost agni#2 — Zed cost
• Allow First Mate to target already-ready units agni#3 — First Mate targets
• Register Mech tokens through the shared spawn path agni#4 — Mech registration
• Enforce September bans for Ekko Recurrent and Stacked Deck agni#5 — bans

The pinned aggregate is public on abysl/agni branch integration/riftbound-audit. It does not merge those PRs into main. Review/merge the individual fixes first; refresh the pin to the resulting main revision before releasing this companion.

Official ban source: https://playriftbound.com/en-us/news/announcements/september-ban-list-updates-effective-september-18-2026 . Exact cards: Ekko, Recurrent and Stacked Deck; Standard and Constructed 2v2, effective September 18, 2026.

Validation

• Focused legality/selection tests: 3 passed; pool tests: 7 passed; network deal-boundary regression passed.
• nix-shell ci/format.nix --run 'treefmt --ci' passed.
• devenv shell -- bash ci/check.sh passed.
• Built the Riftbound Wasm plugin from the matching Agni sibling, then devenv shell -- cargo test --locked --lib: 674 passed, 2 ignored. The initial full run failed because that plugin artifact was absent; it was rebuilt rather than skipping the dependent tests.
• Parent review removed unrelated Windows lock-resolution churn. The final minimized lock passes cargo metadata --locked --offline --format-version 1; full native tests above were run before that non-Linux-edge normalization. GitHub CI checks the final head.
• No screenshot, live multiplayer, Android, or browser end-to-end test is claimed.

Boundaries

No wire/blob/snapshot schema change. This validates the local registered deck at normal app boundaries; the existing peer message carries deal groups, not an authenticated complete registered deck. It is not a new hostile-client tournament-compliance protocol, and does not add retrospective deck validation to the deterministic game fold.