Cloakroom rules: a tested `cloakroom/cloak.js` that plays a whole game from plain data #107

The rules for Cloakroom as a module on its own, so the game can be built on rules already proven, without touching any shared file. This is the first half of #91; the page and the listing follow in the issue that waits for this one.

Done looks like:

• [ ] A rail is dealt from a seed passed in: six pairs in round one, eight in round two, ten in round three. Turning one tag then a second reveals both; a match leaves the rail, a mismatch is counted and both turn back after a pause that is a state in the rules, and a third turn during that pause is ignored. Each round has a 90-second clock.
• [ ] One game is three rounds. A game state reports round, pairs left, mismatches, clock and best, and is over with a win when every round is cleared with 12 or fewer mismatches in all, a loss otherwise or when a clock runs out.
• [ ] cloakroom/cloak.js takes plain data in and returns plain data out (no DOM, no canvas, no timers, no Math.random: randomness comes from a seed passed in), loadable both by a <script> tag (as window global, like the other games' rules) and by import in tests, following the pattern of an existing forged game's rules file such as soapbox-derby/.
• [ ] cloakroom/cloak.test.mjs asserts the seeded deal holds exactly the stated pairs, a match leaves, a mismatch counts and turns back, a third turn during the pause is ignored, the clock running out loses, and the win and loss lines at 12 mismatches. Each test would fail without the rule it names. bun test cloakroom/ passes and so does bun test.
• [ ] No index.html in cloakroom/ yet (that would make playtest.test.mjs require a round before the page exists), and no change to shell.js, index.html, README.md, serve.test.mjs, rounds.mjs or og/.

Files: cloakroom/cloak.js, cloakroom/cloak.test.mjs. Risk: none shared, since both files are new. The rules must expose the state the playtest will read (phase, score, over, outcome line) so the page issue can script a round without reaching into drawing code. Fits: a builder.