feat(rust): the world verbs, their budgets and the reconcile watch (phase 13a, protocol 9)

- registerEventActions: rust.zone.open and rust.prefab.place, both
  reversible 'ledger' with revert() and reconcile(), budgetMs 15000 above the
  client's 12 s. A location is a monument (kind + instance, carrying its
  server) or raw coordinates, exactly one (D87, D93); bounds mirrored from the
  plugin so a bad step is refused on the form (D95); zone minutes required and
  held by the game (D96).
- registerEventBudgets: rust.prefabs, rust.npcs and rust.zone.minutes, each
  beside the verb that spends it (D79, D89).
- Option sources rust.options.monuments (live, searchable) and
  rust.options.prefabs (mirrored, answers with every server off), registered in
  the one batch core accepts alongside the lease sources.
- Refs are <serverId>:<id>, since revert and reconcile get no params. The undo
  sends no idempotency key; a lost answer is reverted by key on every server.
  reconcile asks the plugin, and a server that cannot be asked keeps its rows.
- The refresh's bootId/wipeId watch calls ctx.events.reconcile() on a restart
  or a wipe, never on a first sighting or a reconnect (§11.1).
- The permission mirror keeps the plugin's new notLanded grants out of what it
  records as pushed, and the admin page says so (D85).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/boot.js

@@ -45,6 +45,7 @@ const core = require('./core')
 const db = require('./model/servers/servers.db')
 const engagement = require('./engagement/emit')
 const eventsDb = require('./model/events/events.db')
+const eventWorld = require('./eventWorld')
 const ingest = require('./ingest')
 const permSync = require('./permSync')
 const servers = require('./model/servers/servers.model')
@@ -180,6 +181,11 @@ async function refreshOne(server) {
 
     // After the write, so a transition announced is one a page already shows.
     engagement.serverObserved(server, connected)
+
+    // A restart or a wipe under a running event is the moment core must be told
+    // to ask what the world still holds (§11.1). Only a CONNECTED plugin's hello
+    // counts: a board the game left behind says nothing about now.
+    if (connected) eventWorld.observeServer(server.id, { bootId: frame.bootId, wipeId: frame.wipeId })
   } catch (err) {
     // A failure here is one server's, and it must not reach `Promise.allSettled`
     // as a rejection that hides which one. Log with the id and carry on.