docs(kit): pin core 1.19.0; teach the public demo's module members

The pin moves from 6890a74 (1.17.0) to 69998ec (1.19.0, website#224),
past 1.18.0 (website#223). Both are the public demo (DEMO_MODE.md §10
step 3). The chapters were read again for both versions:

- Chapter 2: a new section on a public demo site, covering demoLocks in
  module.json, ctx.demoMode and api.onDemoSeed (1.18.0). The call count
  becomes twenty.
- Chapter 5: a paragraph on an event action's demoRefuses (1.19.0), and
  a line in the action listing.

The one other core change in the window (website#221) is a wording fix
on core's Teams panel and nothing a module sees. The template declares
none of the new members, so template/module.json's coreApi becomes
^1.19.0 for the equality check only.

Checks run at the new pin:
- checkCoreApi, links, rename sites and chapter paths all pass, and so
  do the script tests (10 and 11).
- The template's imports, build, externals and swagger checks pass.
- Tests pass: server 82, client 20.
- The template was loaded as `examplegame` into a real core at this ref
  through core's own loader, with DEMO_MODE unset and with it true, and
  it registered both times.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

book/05-events.md

@@ -150,6 +150,7 @@ api.registerEventActions([{
   async revert({ runId, resources, idempotencyKey }) {},    // required iff 'ledger'
   async reconcile({ runId, resources }) {},                 // optional
   async progress({ runId, stepId, idempotencyKey, params, resources, viewer }) {}, // optional, 1.12.0
+  async demoRefuses(params) {},                             // optional, 1.19.0
 }])
 ```
 
@@ -189,6 +190,22 @@ event's public page and in the app.
   already cache, not from a fresh round trip to the game per reader.
 - **Failure.** A throw or a late answer costs a line, never the page.
 
+**`demoRefuses` keeps a step off a public demo** (MODULE_API 1.19.0). A demo site
+([chapter 2](02-website-module.md)) lets anybody author an event, and some steps must
+never be saved there: the Rust module refuses a console command that would stop the
+server. Core asks `demoRefuses(params)` only with `DEMO_MODE` on, for every step,
+when a definition is created, saved or published, with the step's checked params.
+
+- **The answer.** A sentence refuses the whole write with `403 DEMO_LOCKED`, and the
+  author reads it as written, so phrase it for them: *"quit" is turned off on the
+  demo site.* `null` lets the step through.
+- **It is a pure check.** No database, no game, nothing changed. A throw refuses too,
+  with core's own sentence, because a lock that cannot decide fails closed.
+- **Check again in `perform()`**, behind `ctx.demoMode`. A version published before
+  your list grew is never asked again, so the save cannot be the only lock.
+- **It needs `coreApi` `^1.19.0`.** An older core never asks it, and the save goes
+  through without a word.
+
 **`example` is required on every param, optional ones included.** It is the
 authoring form's placeholder. It is one word at declaration time and it is
 unreconstructable afterwards by anybody who did not write the action.