Fire control 12.4 closing batch: Death fires once; pin the blast loop's multi-kill and untouched-entity cases

Entity.Death, the owner of the stream, now ends after its first cause. A blast that destroyed a
cockpit fired Death, which removed and deactivated the entity, and the blast's own DamageHull then
raised a second Death to every subscriber but Zone's idempotent handler. Every damage path gets the
guard because none of them raise Death themselves.

New pins: one blast killing three ships (a break after the first kill survives the old suite), a
shieldless ship outside the disc receiving nothing, a cockpit-kill blast and a direct hull kill each
raising Death exactly once.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Assets/Scripts/ServerShared/Entity.cs

@@ -516,7 +516,10 @@ public abstract class Entity
         Death = HullDamage.Where(_ => Hull.Durability < .01f).Select(_ => CauseOfDeath.HullDestroyed)
             .Merge(HeatstrokeDeath.Select(_ => CauseOfDeath.Heatstroke))
             .Merge(HypothermiaDeath.Select(_ => CauseOfDeath.Hypothermia))
-            .Merge(ItemDestroyed.Where(i=>i.GetBehavior<Cockpit>()!=null).Select(_ => CauseOfDeath.CockpitDestroyed));
+            .Merge(ItemDestroyed.Where(i=>i.GetBehavior<Cockpit>()!=null).Select(_ => CauseOfDeath.CockpitDestroyed))
+            // Death is terminal: the first cause ends the stream, so no damage path (a blast whose cockpit kill is
+            // followed by its own hull damage, a second item, a heat tick) can raise it twice to any subscriber.
+            .Take(1);
 
         //CurrentSecurityLevel.Value = SecurityLevel.Open;
     }