feat(rust): permissions as event rewards — lend or give any registered permission (PLAN_REDESIGNS §12)

D342-D346 (docs#342). Two steps over the permission mirror's own tables, so
no plugin, sidecar or protocol change:

- rust.perm.lend, "Permissions until the event ends": a kit reward's lease,
  one rust_perm_run_grants row per recipient per permission, the message on
  one row each; change/ledger with rust.kit.entitle's revert and reconcile;
  budget rust.permissions.
- rust.perm.give, "Permissions for good": a standing rust_perm_grants row per
  website user per permission, scoped to the step's server, source `event`,
  note "event run <run>, step <step>"; a grant already there is left alone,
  and a retry's own grants are counted as given; the message rides a
  notice-only run-grant row; irreversible/none; budget rust.permissions.kept.
- Both: several permissions through core's `multiple` param (MODULE_API
  1.14.0, at most 10); a required "I am sure" toggle refused unticked in the
  dry run and at run time, naming the permissions (D343); a permission the
  server's catalogue lacks refused by name; a blank message tells nobody.
- rust.options.permissions: the enabled servers' catalogues, grouped by the
  registering plugin (by prefix when none), sorted plugin then permission
  without case, a row noted "Only on X" when not on every server.
- Permission manager: an event-given grant shows "given by event run N,
  step M"; staff turn it off like any grant.
- coreApi ^1.14.0; ci/core-ref.json pinned to website#213's head until it
  merges; engagement-triggers.json regenerated; routes.manifest.json
  unchanged (no new routes).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/index.js

@@ -59,6 +59,7 @@ module.exports = function register(ctx, api) {
   const eventLeases = require('./eventLeases')
   const eventWorld = require('./eventWorld')
   const eventRewards = require('./eventRewards')
+  const eventPermRewards = require('./eventPermRewards')
   const eventTemplates = require('./eventTemplates')
   const boot = require('./boot')
   const commands = require('./commands')
@@ -169,8 +170,11 @@ module.exports = function register(ctx, api) {
   // and the chat line, with the two budgets they spend. Registered in the same
   // calls' neighbours, not merged into eventWorld's arrays, so each file keeps
   // its own statement of what it declares.
-  api.registerEventBudgets([...eventWorld.BUDGETS, ...eventRewards.BUDGETS])
-  api.registerEventActions([...eventWorld.ACTIONS, ...eventRewards.ACTIONS])
+  //
+  // Permissions as rewards (PLAN_REDESIGNS.md §12) beside them: any registered
+  // permission, lent until the run ends or given for good, each on its own budget.
+  api.registerEventBudgets([...eventWorld.BUDGETS, ...eventRewards.BUDGETS, ...eventPermRewards.BUDGETS])
+  api.registerEventActions([...eventWorld.ACTIONS, ...eventRewards.ACTIONS, ...eventPermRewards.ACTIONS])
 
   // The templates (PLAN_REDESIGNS.md §2.5, MODULE_API 1.13.0): a kit weekend
   // as a starting point on core's New event screen. Core keeps nothing about a
@@ -188,6 +192,7 @@ module.exports = function register(ctx, api) {
     ...eventLeases.OPTION_SOURCES,
     ...eventWorld.OPTION_SOURCES,
     ...eventRewards.OPTION_SOURCES,
+    ...eventPermRewards.OPTION_SOURCES,
   ])
 
   // The slash commands (phase 16, R11). The handlers run HERE, in the website
@@ -206,10 +211,10 @@ module.exports = function register(ctx, api) {
     streams: STREAMS.length,
     audiences: AUDIENCES.length,
     leases: eventLeases.LEASES.length,
-    actions: eventWorld.ACTIONS.length + eventRewards.ACTIONS.length,
-    budgets: eventWorld.BUDGETS.length + eventRewards.BUDGETS.length,
+    actions: eventWorld.ACTIONS.length + eventRewards.ACTIONS.length + eventPermRewards.ACTIONS.length,
+    budgets: eventWorld.BUDGETS.length + eventRewards.BUDGETS.length + eventPermRewards.BUDGETS.length,
     announceLeg: eventRewards.LEG.leg,
     commands: commands.map((cmd) => cmd.name).join(' '),
-    optionSources: eventLeases.OPTION_SOURCES.length + eventWorld.OPTION_SOURCES.length + eventRewards.OPTION_SOURCES.length,
+    optionSources: eventLeases.OPTION_SOURCES.length + eventWorld.OPTION_SOURCES.length + eventRewards.OPTION_SOURCES.length + eventPermRewards.OPTION_SOURCES.length,
   })
 }