docs(readme): the engagement system, protocol 5, and module-uo v1.1.0

The engagement cutover landed on 2026-09-01 and three things on this page stopped
being true with it.

The capability itself is the reason for the change: the site now talks to its
players, and an operator decides when. It is a headline capability by the org
lead's call, which is the condition ENGAGEMENT.md Phase 13 step 8 attaches to
touching this file at all -- a landing page that lists every feature is a landing
page nobody reads.

The bullet leads with the operator rather than the mechanism, and names the one
property that is a security boundary rather than a feature: a trigger declares
the widest audience a rule may ever be given, so a sensitive game event cannot be
mailed to everyone by a misconfiguration.

The other two are cutover outputs and would mislead an operator directly:

  * the installer's sample output prints "Protocol version 4"; the paired bundle
    is 2026.09.01 and the wire is 5.
  * the quick start pins module-uo v1.0.1 in both the manifest URL and the
    MODULES= line; v1.1.0 is the release that carries the shard triggers.

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -71,6 +71,14 @@ Three layers, and the shape is the same for any game:
 - Players **link** a game account to a website account with a one-time in-game code, which
   is what authorizes character reads. Staff can push town-crier messages and control
   commands back into the game.
+- **The site talks to its players, and an operator decides when.** Anything notable — in the
+  platform or in the game — can be declared as a **trigger**; an operator writes rules against
+  triggers in the admin panel and picks who is told and on which channel: **email** through any SMTP
+  provider, an **on-site inbox**, or a **push** to the Android app. Bodies are editable templates
+  with a live preview, every rule a module ships arrives **switched off**, and each trigger declares
+  the widest audience a rule may ever be given — so a sensitive game event cannot be mailed to
+  everyone by a misconfiguration. A module brings its own triggers: for Ultima Online that is
+  a house about to collapse, a vendor running out of gold, a champion spawn, a new governor.
 - **Accounts are hardened out of the box** — TOTP two-factor with trusted devices, optional
   SSO (Google / Discord / any OIDC provider, link-only: an external identity must already
   belong to an account), bot scoring with automatic IP bans, and rate limiting.
@@ -134,11 +142,11 @@ Ultima Online that manifest is `module-uo-<version>.json` from the
 [Module-uo releases](https://gitea.whitlocktech.com/RunicGateway/Module-uo/releases):
 
 ```
-https://gitea.whitlocktech.com/RunicGateway/Module-uo/releases/download/v1.0.1/module-uo-1.0.1.json
+https://gitea.whitlocktech.com/RunicGateway/Module-uo/releases/download/v1.1.0/module-uo-1.1.0.json
 ```
 
 A compose-managed host can declare the set instead of clicking, with
-`MODULES=uo@1.0.1=<that URL>` — resolution at container start is idempotent and offline-safe,
+`MODULES=uo@1.1.0=<that URL>` — resolution at container start is idempotent and offline-safe,
 so a restart with the network down brings the site up exactly as it was.
 
 > **The module system shipped on 2026-08-12** and this is now simply how the site works — a
@@ -176,7 +184,7 @@ unprivileged account, and finishes by printing the four values to paste into **A
 ```
 Base URL          http://<shard-host>:8080
 WebSocket URL     ws://<shard-host>:8080/ws
-Protocol version  4
+Protocol version  5
 Auth token        4f9c…
 ```