[Bug]: [P3] deserialize leaves four fields uncoerced: towerName, builtWeddingHall, evaluatedTower, completeAt

Scope widened by the full repository audit (2026-07-21, finding AUD-013; report at _bmad-output/planning-artifacts/reviews/full-repository-audit-2026-07-21/): two more uncoerced fields found beyond the original pair. Backlog row deserialize-null-hardening updated to match.

Simulation.deserialize hardens nearly every field (money, star, minutes, ids, geometry, rent, schedules, transport arrays), but four assignments still ride raw:

1. sim.tower.towerName = data.towerName (src/engine/sim/serialization.ts:448): a forged non-string reaches the UI and re-serializes.
2. sim.tower.builtWeddingHall = data.builtWeddingHall (:449): a forged truthy non-boolean survives.
3. sim.evaluatedTower = data.evaluatedTower (:90): a forged truthy flows into the vipVisits backfill and TOWER-status gating.
4. Unit completeAt rides the ...u spread with no num() coercion (unlike vacateAt): a forged NaN makes finishConstruction's sim.clock.minutes >= (u.completeAt ?? 0) false forever, so the unit is permanently stuck under construction, and serializeUnit writes the NaN back out.

Fix: four one-liners in the existing coercion pattern (string coerce + cap for towerName, === true for the two booleans, num() for completeAt).

Required tests: forged-save fixtures for each field, including the stuck-construction repro (NaN completeAt, tick past the horizon, assert the unit finishes), in the storage integration suite alongside the #306 coverage.

Save round-trip work: /gds-code-review.

Start in src/engine/sim/serialization.ts at the assignments around lines 448-449, the evaluatedTower assignment near line 90, and the unit spread handling completeAt. Read the existing coercion patterns, then locate the storage integration suite and its #306 coverage. Done means forged-save tests cover all four fields, including ticking past a NaN completeAt horizon and confirming construction finishes.