Fleet: get_fleet (read, handles not-in-fleet); guarded invite_to_fleet and update_fleet. UI: guarded set_waypoint and open_window (market/info/contract). All writes go through write-safety. Closes #27, #28. 128 tests, coverage 89%. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>