Pool admin: empty-pool safety net + honest removal copy (Codex audit)

Two hardening fixes from Codex's audit:
- _pick_answer falls back to the curated baseline if the live pool is empty,
  so an admin tombstoning every answer in a variant can't divide-by-zero the
  daily picker. Test added (test_picker_survives_empty_live_pool). Chosen over
  a minimum-count block: robust without refusing legitimate removals.
- Removal copy is now honest — "Removed from future puzzles (today's answer is
  already set)" — since a tombstone doesn't rewrite today's generated
  daily_puzzles row. Panel intro updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

goodnews/games.py

@@ -193,6 +193,8 @@ def _recent_answers(conn: sqlite3.Connection, variant: str, limit: int) -> set[s
 
 def _pick_answer(conn: sqlite3.Connection, date: str, variant: str) -> str:
     pool = answer_pool(conn, variant)
+    if not pool:  # safety net: removals must never empty the pool — fall back to curated
+        pool = sorted(_POOL.get(variant, []))
     recent = _recent_answers(conn, variant, max(1, len(pool) // 2))
     start = _seed(date, "word", variant) % len(pool)
     for i in range(len(pool)):