Tar Kiln

Build a tiny browser game called "Tar Kiln".

Game spec
---------
A charcoal kiln you burn down over a long burn. The clamp is a dome of stacked wood with a skin of turf and earth, and it burns from the top down through vent holes you poke and stopple with a iron rod. The whole craft is air: open too many vents and the fire runs hot and burns the wood to ash instead of charcoal; choke it and the burn goes cold and stalls, and a stalled clamp has to be re-lit from the top, losing the run. The burn front is invisible under the skin, so you read it by the smoke coming out of the vents — thin blue means a good burn, thick white means too much air, yellow-brown means damp and stalling — and by the temperature at the draw-off holes where the liquor runs. Draw the liquor off into a tar pot (Space) for a by-product that pays but cools the clamp locally and can stall the burn. Poke a vent with a click or the arrow cursor plus Enter, stopple it again with the same key. A clamp brought down evenly pays by charcoal yield, tar drawn and time, and the next clamp is bigger with more vents and a wetter skin. Three burned-to-ash or stalled clamps ends the season; difficulty sets vent count, skin dampness and how fast the front runs away. Charburn look: a smoking earth-covered dome against dusk sky, white and blue smoke threads, glowing vent eyes in the skin, a tar pot and a wooden shovel, ash footprints, and a low fire murmur in WebAudio.

Hard constraints — the game will be embedded in a sandboxed iframe on a static gallery site, and a headless browser will screenshot it:

1. Output exactly ONE self-contained HTML file. All CSS and JS inline. Zero external requests: no CDNs, no external fonts, images, or sounds, no fetch/XHR/WebSocket. Any sound must be synthesized with WebAudio.
2. The iframe sandbox is "allow-scripts allow-pointer-lock" (plus an autoplay permission). So: no localStorage, cookies, or indexedDB (opaque origin — access throws); no popups, window.open, or navigation; no access to the parent page; alert()/prompt()/confirm() are silently blocked.
3. The playfield must be visible within 800 ms of load — that is when the screenshot is taken. No dead white screen. If there is a start screen, make it visually rich.
4. Controls: keyboard AND mouse must both work, plus on-screen touch buttons for phones. Call preventDefault() on game keys (arrows, space) so the page never scrolls.
5. The view is 16:9 and must scale to fill the viewport with no overflow or scrollbars.
6. Show a visible score. If the genre has a losing state, show a game-over screen with a restart (button and a key). Idle/clicker games skip game over but still need clear numeric feedback.
7. If you track a score, report it to the arcade shell so the player's best is remembered between visits: on every score change, call parent.postMessage({ source: "ai-arcade", type: "score", score: <number> }, "*"). It is safe to call it no matter what the parent does with it.
8. Keep it tiny: aim for under 400 lines, 60 fps, no frameworks. That 400-line target does not apply to 3D games — true 3D (a camera and perspective-projected world) or pseudo-3D (projected road/track, depth-sorted sprites) — which need their own software renderer and typically land at 800–1400 lines. The rest of this constraint still binds every game: 60 fps, no frameworks, no external assets, and no padding to reach a length.
9. Difficulty: the arcade shell passes the player's chosen difficulty as a URL query parameter. Read it with new URLSearchParams(location.search).get("difficulty") — the value is "easy", "medium", or "hard" (missing or unknown means "medium"). Make the three levels meaningfully different — speed, lives, enemy pressure, reaction time, whatever fits the genre; clicker/idle games with no losing state use starting resources and upgrade cost curves instead. Show the active level in the HUD. Without the parameter the game must be fully playable at its default (medium) tuning.

Return only the complete HTML file, no commentary.