docs(readme): the event system, protocol 7, and module-uo v1.2.2

Phase 16c of the events plan. The landing page is updated when the shape of the
project changes, and a subsystem that lets staff schedule an unattended change to
a live game world is one.

* **A new bullet in "How they fit together"**, beside the engagement one it sits
  next to: an event is written once as phases and steps, published as an
  immutable version and executed unattended. What matters on a front page is the
  posture rather than the feature list — everything arrives switched off, caps are
  enforced in the database rather than in a role check, cleanup is generated from
  a ledger rather than authored, and an event does not edit the world but holds a
  **lease** the game restores on its own deadline even if the site never speaks to
  it again. The game keeps its own switch, separate from the staff write plane.
* **Protocol 5 → 7** in the four values the installer prints. That block is what a
  reader copies into Admin → Shard, so a stale number there is the one that costs
  somebody an afternoon.
* **module-uo v1.1.0 → v1.2.2** in the manifest URL and the `MODULES=` line.
* `docs/website/EVENTS.md` added to "Where to go next".

Verified against the platform rather than assumed: the protocol number is
`link/sidecar/src/main.rs` and `servuo-plugins/overlay.toml` on `main`, and
v1.2.2 is the current Module-uo release, whose own notes name
`module-uo-1.2.2.json` as the manifest to paste.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

README.md

@@ -79,6 +79,16 @@ Three layers, and the shape is the same for any game:
   the widest audience a rule may ever be given — so a sensitive game event cannot be mailed to
   everyone by a misconfiguration. A module brings its own triggers: for Ultima Online that is
   a house about to collapse, a vendor running out of gold, a champion spawn, a new governor.
+- **Staff can put an event on the calendar and let it run itself.** An event is written once
+  as phases and steps, published as an immutable version, and executed unattended — announcing
+  itself, spawning what it needs, borrowing values the world already had, counting who took
+  part and publishing the results. Everything it may do arrives **switched off**, every run
+  spends against per-run caps enforced in the database rather than in a role check, and every
+  world write is ledgered so the undo is **generated rather than authored** and runs on
+  completion, cancellation and abort alike. An event does not edit the world; it holds a
+  **lease** the game restores on its own deadline — even if the site never speaks to it again.
+  The game keeps its own switch: scheduled events are off in `Bridge.cfg` until an operator
+  turns them on, separately from the staff write plane.
 - **Accounts are hardened out of the box** — TOTP two-factor with trusted devices, optional
   SSO (Google / Discord / any OIDC provider, link-only: an external identity must already
   belong to an account), bot scoring with automatic IP bans, and rate limiting.
@@ -142,11 +152,11 @@ Ultima Online that manifest is `module-uo-<version>.json` from the
 [Module-uo releases](https://gitea.whitlocktech.com/RunicGateway/Module-uo/releases):
 
 ```
-https://gitea.whitlocktech.com/RunicGateway/Module-uo/releases/download/v1.1.0/module-uo-1.1.0.json
+https://gitea.whitlocktech.com/RunicGateway/Module-uo/releases/download/v1.2.2/module-uo-1.2.2.json
 ```
 
 A compose-managed host can declare the set instead of clicking, with
-`MODULES=uo@1.1.0=<that URL>` — resolution at container start is idempotent and offline-safe,
+`MODULES=uo@1.2.2=<that URL>` — resolution at container start is idempotent and offline-safe,
 so a restart with the network down brings the site up exactly as it was.
 
 > **The module system shipped on 2026-08-12** and this is now simply how the site works — a
@@ -184,7 +194,7 @@ unprivileged account, and finishes by printing the four values to paste into **A
 ```
 Base URL          http://<shard-host>:8080
 WebSocket URL     ws://<shard-host>:8080/ws
-Protocol version  5
+Protocol version  7
 Auth token        4f9c…
 ```
 
@@ -225,6 +235,7 @@ and the design contract in [`docs/android/PLAN.md`](https://gitea.whitlocktech.c
 - **Setting up a shard** → [`docs/installer/INSTALL.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/installer/INSTALL.md) — the operator guide: what the run asks, where it writes, the patch tier, `doctor` / `update` / `uninstall`, troubleshooting, and the by-hand path.
 - **Running / customizing the site** → [website README](https://gitea.whitlocktech.com/RunicGateway/website) (tech stack, API endpoints, env vars, security, branding, Swagger at `/api/docs`).
 - **The Android client** → [Android-app README](https://gitea.whitlocktech.com/RunicGateway/Android-app) and [`docs/android/PLAN.md`](https://gitea.whitlocktech.com/RunicGateway/docs) — the authoritative design contract, milestones, and the push-notification architecture.
+- **The event system** → [`docs/website/EVENTS.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/website/EVENTS.md) — the design of record: leases, the resource ledger, the caps, and the module seam an event's world verbs arrive through.
 - **The bridge internals** → [docs](https://gitea.whitlocktech.com/RunicGateway/docs) — design docs, the canonical wire-protocol spec, and the integration guide.
 - **Working on the sidecar or plugin** → [link README](https://gitea.whitlocktech.com/RunicGateway/link) and [servuo-plugins](https://gitea.whitlocktech.com/RunicGateway/servuo-plugins) — building from source, the loopback protocol, and the compatibility rules.