feat(cwg): integrate JATOS sealed-dyad lobby

[htsukamoto5]

Summary

• vendors the JATOS multiplayer adapter from upstream jspsych-multiplayer PR #88 at 466fe5f486e2cbff4259b41e14d2fd7f63c5ea9a, with provenance and checksum
• derives dyad identity from the JATOS group, admits exactly two assigned members through a two-sided readiness handshake, then seals the group
• adds a repeatable JATOS .jzip build and regression checks for the JATOS admission boundary
• retains the visible five-minute lobby countdown while a second group member has not yet reached the lobby, rather than applying the shorter task connection timeout

Dependencies and status

• Base: eat/lobby-timeout-no-match (PR Bound the lobby, and pay everyone who never got a game (C&WG) #18), the current top of the C&WG paid-run stack.
• Upstream adapter: jspsych/jspsych-multiplayer PR #88, still unmerged. This PR vendors its pinned head; revisit the adapter if upstream changes before publication.
• This is pilot infrastructure, not a launch-ready study: payment activation, production DataPipe configuration, consent/debrief, and study polish are deliberately out of scope.

JATOS lifecycle boundary

JATOS can deliver member-leave before member-close. During that brief transition, the departed participant is absent from assigned membership yet may still appear in open channels. Accordingly, admission and departure logic treats assigned membership/leave as authoritative; open-channel count is not used to reject a valid two-sided readiness handshake.

How to test

1. Build/import dist/reference-game-cwg-jatos.jzip as a JATOS group study, then launch two runs in the same group.
2. Enter a display name in both tabs. Both should leave the lobby, be assigned complementary roles, and begin the six-round task.
3. Start a second run with only one tab entering its name. Its lobby display should visibly count down for the full five-minute budget; it should not fail after the task's shorter connection timeout.
4. Complete a normal dyad run and export both JATOS result files. Confirm shared dyad_id / jatos_group_id, distinct participant IDs, complementary roles, six aligned round records, and a complete outcome.
5. Optionally exercise a departure: after sealing, close one participant and confirm a new arrival is placed in a new group rather than replacing them in the sealed group.

Validation completed

• Live JATOS two-run testing: shared group assignment, dyad admission/sealing, post-seal replacement prevention, clean disconnect lifecycle, delayed JATOS initialization, missed initial presence events, and the lobby readiness/countdown race.
• Regression tests:
  ode tests/jatos.test.mjs,
  ode tests/pipeline.test.mjs,
  ode tests/exits.test.mjs, and
  ode tests/dropout.test.mjs.

[htsukamoto5]

Closing unmerged because the first paid-study target moved from C&WG to Hawkins. This C&WG-specific JATOS integration should not remain open as the active path; any JATOS/group-presence work that is still needed should be reintroduced on top of the Hawkins paid-pilot direction after #24/#19 are settled.