fix per-player-shroud desyncs

don't disallow attack orders on one client only
- by GPS status
- if the actor is mobile (this should not be hard-coded)
- you think it is invisible (broken by DevShroud cheat)

dont judge visibility by allied stance (what about creeps?)