Coconut Shy rules: a tested `coconut-shy/shy.js` that plays a whole game from plain data #105

The rules for Coconut Shy as a module on its own, so the game can be built on rules already proven, without touching any shared file. This is the first half of #85; the page and the listing follow in the issue that waits for this one.

Done looks like:

• [ ] A throw is a power and an angle; the rules return where the ball lands along the line of posts. A hit inside the square window (stated, at least a third of the coconut's width) knocks the coconut off; a glancing hit wobbles it, and a coconut wobbled twice falls. A round is five balls, with a bonus ball when every coconut is down. Posts move further back each round.
• [ ] One game is three rounds. A game state reports round, balls left, coconuts down and best, and is over after round three with a win at 9 or more down and a loss below.
• [ ] coconut-shy/shy.js takes plain data in and returns plain data out (no DOM, no canvas, no timers, no Math.random: randomness comes from a seed passed in), loadable both by a <script> tag (as window global, like the other games' rules) and by import in tests, following the pattern of an existing forged game's rules file such as soapbox-derby/.
• [ ] coconut-shy/shy.test.mjs asserts the square window and the glancing wobble, the second wobble falling, the bonus ball, posts moving back per round, and the win and loss lines at 9. Each test would fail without the rule it names. bun test coconut-shy/ passes and so does bun test.
• [ ] No index.html in coconut-shy/ yet (that would make playtest.test.mjs require a round before the page exists), and no change to shell.js, index.html, README.md, serve.test.mjs, rounds.mjs or og/.

Files: coconut-shy/shy.js, coconut-shy/shy.test.mjs. Risk: none shared, since both files are new. The rules must expose the state the playtest will read (phase, score, over, outcome line) so the page issue can script a round without reaching into drawing code. Fits: a builder.