feat(rust): Run console commands and Reward by console command (PLAN_REDESIGNS §16)

Two event steps in server/eventCommands.js, on one new budget,
`rust.commands` (D382-D385):

- rust.command.run: up to 10 typed commands once on one server, with
  optional teardown commands. irreversible / ledger: the ledger row keeps
  the teardown as it was, and core reverts it when the run ends or is
  cancelled. Priced one unit per command, teardown included.
- rust.command.reward: the kit reward's recipient picker (tally modes and
  linked), by Steam id, so no website account is needed. The bridge fills
  {steamid} and {name}; offline recipients are skipped and named (D383).
  irreversible / none. Priced commands x people, the bound for a mode that
  is not a count.

Both take core's `multiple` string field as a free text box (no
allowlist, D384) and a required "I am sure" toggle. {steamid}/{name} in a
run step are refused. unknown-command, malformed, events-disabled,
interrupted are permanent; the error says how many ran before it.

D385: the run also hands its teardown to the bridge, which keeps it with
the key. A revert with only the key (the step failed, or its answer was
lost, so core recorded nothing) asks every enabled server to run what it
kept; a server the step never reached runs nothing.

sidecarClient.commandsRun -> POST /commands/run; ci/bundle.json lists the
new file; entry.test.js pins the new ids; 21 tests in
test/commandSteps.test.js.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/entry.test.js

@@ -158,6 +158,8 @@ test('the event verbs are registered, and every budget has a verb that spends it
     'rust.announce',
     'rust.backpack.size',
     'rust.coins.pay',
+    'rust.command.reward',
+    'rust.command.run',
     'rust.crate.place',
     'rust.dt.start',
     'rust.gc.place',
@@ -174,6 +176,7 @@ test('the event verbs are registered, and every budget has a verb that spends it
     'rust.announcements',
     'rust.backpacks',
     'rust.coins',
+    'rust.commands',
     'rust.dt.events',
     'rust.gc.crates',
     'rust.grants',
@@ -209,8 +212,9 @@ test('the event verbs are registered, and every budget has a verb that spends it
   // not undone, and nor is a world event called (D354): a cargo ship or a drop
   // may already hold players or their loot; nor a Dangerous Treasures event
   // started, which DT despawns itself (§14.3.4); nor a guarded crate placed,
-  // which Guarded Crate cannot end alone (§14.3.5, D373).
-  const once = new Set(['rust.announce', 'rust.participation.collect', 'rust.coins.pay', 'rust.perm.give', 'rust.world.call', 'rust.dt.start', 'rust.gc.place'])
+  // which Guarded Crate cannot end alone (§14.3.5, D373); nor a reward run by
+  // console command, which no command can run backwards (§16.3).
+  const once = new Set(['rust.announce', 'rust.participation.collect', 'rust.coins.pay', 'rust.perm.give', 'rust.world.call', 'rust.dt.start', 'rust.gc.place', 'rust.command.reward'])
   for (const a of actions) {
     assert.strictEqual(a.reversible, once.has(a.id) ? 'none' : 'ledger', a.id)
     // Every param source is one this module registers.