Fix: InvincibleVisitors mob-targeting protection incorrectly blocks XP orbs from tracking visitors

[Copilot]

EXPERIENCE_PICKUP flag set to Visitor rank had no effect — visitors still couldn't pick up XP on other islands when Invincible Visitors was enabled with ENTITY_ATTACK.

Root Cause

InvincibleVisitorsListener.onVisitorTargeting (HIGHEST priority) cancels EntityTargetLivingEntityEvent for any entity targeting a visitor not on their own island. Experience orbs use this same event to home in on players, so they were caught by the mob-targeting suppression — orbs never flew toward visitors, making pickup effectively impossible.

Fix

• InvincibleVisitorsListener: Skip cancellation when e.getEntity() instanceof ExperienceOrb. XP orbs can't harm players; the EXPERIENCE_PICKUP flag on PaperExperiencePickupListener/ExperiencePickupListener already governs whether pickup is actually allowed.

if (!(e.getTarget() instanceof Player p) ||
        !this.getIWM().inWorld(world) ||
        e.getTarget().hasMetadata("NPC") ||
        e.getEntity() instanceof ExperienceOrb ||   // ← new
        this.getIslands().userIsOnIsland(world, User.getInstance(e.getTarget())) ||
        ...

• InvincibleVisitorsListenerTest: Added tests covering mob targeting cancellation, XP orb targeting (must not cancel), no ENTITY_ATTACK in IV settings, and island-owner (non-visitor) path.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud