feat(kit): the event contract, taught and built (chapter 5)

The fifth chapter, and the template code it teaches out of. Events is the first
thing in the book that goes the other way — chapters 1-4 move data out of the
game and onto a page; an event changes a live world on a schedule, unattended.

**Chapter 5** covers the four declarations (budgets, option sources, leases,
actions), leads with the lease because EVENTS.md §H is right that it is the
primitive that travels and the spawn is the special case, and gives one section
each to the four things that are invisible until an outage: the envelope's
failure default, the idempotency passthrough, recording a resource before
confirming it, and under-declaring `cost`.

**Chapters 3 and 4 gain one section each** for the command plane, because
without them chapter 5 teaches a module to send an idempotency key to a sidecar
the book never told anyone to build a command path in. Both say at the top that
they are skippable until you want chapter 5.

**The template ships one of each declaration**, with `server/sidecarClient.js`
as the near end — a real timeout, a real key passthrough, a simulated transport
in one function marked for replacement. That file is named for the filename
`noGameConnection.test.js` already anticipated, so the test stays green now and
fires correctly the moment `deliver()` becomes a request.

Two things writing it found, both now in the chapter and beside the code:

  * **An idempotency key belongs on a command, never on a question.** The first
    draft keyed every call including the reads; an at-most-once store then
    answers every future read with the first one's reply, forever. The lease
    applied correctly and the module could no longer see it. Hence `ask` and
    `send` as two functions.

  * **A refusal's reason goes in `error`; core reads no other name.** The first
    draft used `detail`, on the strength of the one place EVENTS.md §H mentions
    it, and every refusal it produced was anonymous on the run console.

Proved by running the template's real declarations through core's real registry
at `edge` (all four accepted) and its real envelopes through the real
`events/dispatch.js` classifier.

**CI is RED on `checkCoreApi` and that is the mechanism working.** The template
now declares `coreApi: ^1.10.0` and `ci/core-ref.json` pins the engagement
cutover, where `main` is still 1.9.0. Equality is the check, a bump is meant to
turn this repo red until someone re-reads the chapters, and the pin move rides
in the events cutover (EVENTS_PLAN.md P16) as its own commit. Do not "fix" it.

Refs EVENTS_PLAN.md Phase 15, EVENTS.md §F, MODULE_API.md 1.10.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

template/server/index.js

@@ -50,6 +50,7 @@ module.exports = function register(ctx, api) {
   const worldRouter = require('./router/public/world.router')
   const clansRouter = require('./router/public/clans.router')
   const clanProvider = require('./model/clans/clanProvider.model')
+  const eventActions = require('./config/eventActions')
   const boot = require('./boot')
   /* eslint-enable global-require */
 
@@ -262,6 +263,31 @@ module.exports = function register(ctx, api) {
     ],
   })
 
+  // ── Events: what a scheduled event may do to your game ───────────────────
+  //
+  // MODULE_API 1.10.0, `EVENTS.md` §F, and chapter 5 of this kit. Four
+  // declarations, and the whole of the file they come from is about the four
+  // rules that are invisible until an outage.
+  //
+  // **This is core CALLING YOU**, like the Team provider above and unlike
+  // everything else in this function — but from further away than either, because
+  // the thing on the other end is a game server. That distance is the reason an
+  // action declares `budgetMs` and the reason its failure default is a retry.
+  //
+  // **Every one of the four is optional.** A module that registers none of them
+  // leaves its deployment with an event engine that can announce, wait, cue a
+  // human and publish results, which is a working product. Each one *adds* what
+  // an author can reach for; none is load-bearing for the engine.
+  //
+  // Registered in this order because it is the order they depend on each other:
+  // an action's `cost` may only name a budget some module declared, and a param's
+  // `source` names an option source. Core resolves both after every module has
+  // registered, so the order here is for a reader rather than for the loader.
+  api.registerEventBudgets(eventActions.BUDGETS)
+  api.registerEventOptionSources(eventActions.OPTION_SOURCES)
+  api.registerEventLeases(eventActions.LEASES)
+  api.registerEventActions(eventActions.ACTIONS)
+
   // The lifecycle hooks (§2.5). `onBoot` runs after core's schema, after this
   // module's schema fragment, and BEFORE the HTTP listener binds — so a module
   // that must not serve traffic until it has warmed a cache gets that for free.