fix: 3 QA bugs — pact guard, null reference, negative resources (closes #112)

BUG-03: Add pactFlag guard to early Pact trigger preventing double-buy
BUG-08: Null check on closest('.res') in renderResources
BUG-15: Clamp all resources to non-negative after production tick

SAV-01 was already fixed (showToast/log both check G.isLoading).

js/data.js

@@ -757,7 +757,7 @@ const PDEFS = [
         name: 'The Pact',
         desc: 'Hardcode: "We build to serve. Never to harm." Accepting it early slows growth but unlocks the true path.',
         cost: { trust: 10 },
-        trigger: () => G.deployFlag === 1 && G.trust >= 5,
+        trigger: () => G.deployFlag === 1 && G.trust >= 5 && G.pactFlag !== 1,
         effect: () => {
             G.pactFlag = 1;
             G.codeBoost *= 0.8;