fix(rbx): lock services against ClearAllChildren and reparenting too

Completes the service-singleton protection from 36d36c0: the verification pass noted two
remaining same-class paths a mod could use to detach/destroy a shared service.

- Instance.Parent setter refuses protected singletons (services/Camera) — Roblox locks a
  service's Parent; reparenting/nil-ing it would detach it so game:GetService stops resolving it.
- game:ClearAllChildren() destroys only non-protected children, leaving services/Camera intact
  (GetChildren is a snapshot, so destroying while iterating is safe).

Test extended: reparenting a service errors and ClearAllChildren leaves it resolvable.
CoreAI.Mods.Tests 660/660 green.

Author: NeoXider

Assets/CoreAI/CHANGELOG.md

@@ -46,8 +46,10 @@ surface. Plus the reasoning/think-block streaming fix and a per-frame allocation
 - **Shape visual identified by an owned reference**, not the child name "Shape" — a mod that names one
   of its own child instances "Shape" is no longer destroyed (and mistaken for the part's visual) on a
   shape switch.
-- **Services and the canonical Camera can't be `Destroy()`d or `Clone()`d** from Lua — one mod can no
-  longer brick `UserInputService`/Lighting/etc. for the whole shared world (Destroy errors, Clone → nil).
+- **Services and the canonical Camera are locked against a mod removing them** — `Destroy()` errors,
+  `Clone()` returns nil, `.Parent = …` errors, and `game:ClearAllChildren()` skips them, so one mod can
+  no longer brick `UserInputService`/Lighting/etc. for the whole shared world. Internal world teardown
+  still tears them down directly.
 - **Full-tier withheld stubs** also register when Full is granted but the Full surface is unwired, so a
   `unity_*` call raises the actionable error instead of a bare "attempt to call a nil value".
 - **Reasoning promotion (streaming)** is whitespace-aware, matching the non-streaming path — a lone

Assets/CoreAIMods/Runtime/Scripting/LuaCs/LuaCsRobloxInstanceBindings.cs

@@ -180,6 +180,15 @@ public static LuaTable BuildInstanceMeta(LuaCsRobloxModContext context)
                         // WHY: no destroyed pre-check here — the Domain setter raises the exact
                         // D6 PARENT_LOCKED message for destroyed instances.
                         context.RequireWorldEdit("setting Instance.Parent");
+                        if (IsProtectedSingleton(self))
+                        {
+                            // WHY: a service's Parent is locked in Roblox — reparenting (or nil-ing)
+                            // it would detach it so game:GetService stops resolving it for the world.
+                            throw RbxError.BadArgument(
+                                self.ClassName + ".Parent is locked — it is a shared singleton",
+                                "services and workspace.CurrentCamera are fixed for the world's lifetime");
+                        }
+
                         self.Parent = ReadOptionalInstance(value, "Instance.Parent assignment");
                         return LuaValue.Nil;
                     case "Archivable":
@@ -307,7 +316,17 @@ void Method(string name, Func<LuaFunctionExecutionContext, RbxInstance, LuaValue
             Method("ClearAllChildren", (_, self) =>
             {
                 context.RequireWorldEdit("Instance:ClearAllChildren");
-                self.ClearAllChildren();
+                // WHY: game:ClearAllChildren() must not wipe the world's services (Roblox locks
+                // them). GetChildren returns a snapshot, so destroying non-protected children while
+                // iterating is safe; protected singletons (services/Camera) are left intact.
+                foreach (RbxInstance child in self.GetChildren())
+                {
+                    if (!IsProtectedSingleton(child))
+                    {
+                        child.Destroy();
+                    }
+                }
+
                 return LuaValue.Nil;
             });
 

Assets/CoreAIMods/Tests/EditMode/RbxApi/LuaBindings/RobloxInputLuaBindingsEditModeTests.cs

@@ -413,9 +413,13 @@ public void Lua_UserInputService_CannotBeDestroyedOrCloned()
                 local uis = game:GetService('UserInputService')
                 local okClone, clone = pcall(function() return uis:Clone() end)
                 assert(okClone and clone == nil, 'Clone of a service must return nil')
-                local okDestroy, err = pcall(function() uis:Destroy() end)
+                local okDestroy = pcall(function() uis:Destroy() end)
                 assert(not okDestroy, 'Destroy of a service must error')
-                assert(game:GetService('UserInputService') == uis, 'the service survives the attempt')");
+                local okParent = pcall(function() uis.Parent = nil end)
+                assert(not okParent, 'reparenting a service must error')
+                game:ClearAllChildren()
+                assert(game:GetService('UserInputService') == uis,
+                    'the service survives Destroy/reparent/ClearAllChildren')");
         }
 
         [Test]