feat(kit): the event contract, taught and built (chapter 5)

The fifth chapter, and the template code it teaches out of. Events is the first
thing in the book that goes the other way — chapters 1-4 move data out of the
game and onto a page; an event changes a live world on a schedule, unattended.

**Chapter 5** covers the four declarations (budgets, option sources, leases,
actions), leads with the lease because EVENTS.md §H is right that it is the
primitive that travels and the spawn is the special case, and gives one section
each to the four things that are invisible until an outage: the envelope's
failure default, the idempotency passthrough, recording a resource before
confirming it, and under-declaring `cost`.

**Chapters 3 and 4 gain one section each** for the command plane, because
without them chapter 5 teaches a module to send an idempotency key to a sidecar
the book never told anyone to build a command path in. Both say at the top that
they are skippable until you want chapter 5.

**The template ships one of each declaration**, with `server/sidecarClient.js`
as the near end — a real timeout, a real key passthrough, a simulated transport
in one function marked for replacement. That file is named for the filename
`noGameConnection.test.js` already anticipated, so the test stays green now and
fires correctly the moment `deliver()` becomes a request.

Two things writing it found, both now in the chapter and beside the code:

  * **An idempotency key belongs on a command, never on a question.** The first
    draft keyed every call including the reads; an at-most-once store then
    answers every future read with the first one's reply, forever. The lease
    applied correctly and the module could no longer see it. Hence `ask` and
    `send` as two functions.

  * **A refusal's reason goes in `error`; core reads no other name.** The first
    draft used `detail`, on the strength of the one place EVENTS.md §H mentions
    it, and every refusal it produced was anonymous on the run console.

Proved by running the template's real declarations through core's real registry
at `edge` (all four accepted) and its real envelopes through the real
`events/dispatch.js` classifier.

**CI is RED on `checkCoreApi` and that is the mechanism working.** The template
now declares `coreApi: ^1.10.0` and `ci/core-ref.json` pins the engagement
cutover, where `main` is still 1.9.0. Equality is the check, a bump is meant to
turn this repo red until someone re-reads the chapters, and the pin move rides
in the events cutover (EVENTS_PLAN.md P16) as its own commit. Do not "fix" it.

Refs EVENTS_PLAN.md Phase 15, EVENTS.md §F, MODULE_API.md 1.10.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

template/README.md

@@ -15,6 +15,9 @@ Installed into a core, it adds:
   for the deployment — the one registration where core calls YOU and waits;
 - **three inverted extension slots**, declared by this module on the clan page for
   core to fill;
+- **four event declarations** — a budget dimension, an option source, a lease and
+  one action that ledgers what it makes — so an event authored on the website can
+  reach the game and be undone afterwards;
 - **both lifecycle hooks**, so there is something to see at boot and at shutdown.
 
 That is deliberately less than your module will do. What it is *complete* about is
@@ -28,7 +31,9 @@ module.json                 what core reads first — id, version, coreApi, moun
 server/
   index.js                  register(ctx, api) — the entire server-side handshake
   core.js                   the lazy accessors over ctx; read this second
-  boot.js                   onBoot / onShutdown
+  boot.js                   onBoot / onShutdown, and the game-restart watch
+  sidecarClient.js          the one file that talks to your sidecar — transport simulated
+  config/eventActions.js    budgets, option sources, leases and actions — read chapter 5
   db/schema.sql             idempotent, replayed every boot
   db/purge.sql              destructive, run only by an explicit admin purge
   model/worldStatus/        the .db.js / .model.js pair
@@ -38,6 +43,7 @@ server/
   scripts/checkImports.js   the module boundary, enforced
   scripts/swaggerFragment.js  generates swagger-fragment.json from your own routes
   test/                     the suites — start with entry.test.js
+  test/eventActions.test.js the four traps chapter 5 is about, each as a failing test
 client/
   vite.config.js            the library build: anchored aliases, external: []
   src/entry.jsx             registers routes, nav and declared slots at evaluation time
@@ -113,6 +119,7 @@ backticking table names**.
 | `server/package.json` | package `name` and `description` |
 | `server/core.js` | the message every accessor throws |
 | `server/index.js` | the trigger, audience, template and rule-group ids — all four are namespaced with your module id, and core refuses them otherwise |
+| `server/config/eventActions.js` | the budget, option-source, lease and action ids — four separate id spaces, each namespaced with your module id — and every command name the client sends |
 | `server/boot.js` | the placeholder world name |
 | `server/db/schema.sql` | every table name — the prefix must be your id |
 | `server/db/purge.sql` | the same table names |
@@ -125,6 +132,7 @@ backticking table names**.
 | `server/scripts/swaggerFragment.js` | the generated fragment's `info.title` |
 | `server/test/_fakes.js` | `ctx.moduleId` |
 | `server/test/entry.test.js` | the trigger id the world-status test asserts |
+| `server/test/eventActions.test.js` | the action and lease ids it looks up, and the clan fixture |
 | `server/test/worldStatus.test.js` | the fixture's world name |
 | `server/test/clanProvider.test.js` | the fixture's world name |
 | `server/package-lock.json` | **regenerated** — `npm install --prefix server` |
@@ -147,6 +155,13 @@ placeholder and is not listed fails the build, and so does a listed file with
 nothing left to rename. A checklist nobody verifies is a checklist that is wrong
 by the second edit.
 
+**`server/sidecarClient.js` is not on that list and is not an oversight.** It
+carries no placeholder id — its vocabulary is the game's, not the module's — so
+the checker has nothing to hold it to. It is still the file you have the most work
+in: replace `deliver()` with one request to your sidecar, replace the fake game's
+verbs with your game's, and set `TIMEOUT_MS` to what your transport actually
+waits. Chapter 5 is mostly about that file.
+
 Two things you do **not** rename: the mount prefixes `/world` and `/clans` need
 not be your id (the server's prefix namespace is shared with core's — `/status`,
 `/settings`, `/version`, `/contact` and `/teams` are already taken, which is why