feat(rust): the kit weekend, linked rewards, reward messages and the kit warning (protocol 14)

PLAN_REDESIGNS §2, the Rust half (D164, D192, D332, D333):
- rust.template.kit_weekend (core registerEventTemplates, MODULE_API 1.13.0):
  inputs kit/minutes/message/delivery; one phase advance after the weekend,
  core.lease rust.group.permission default/<kit permission> + rust.kit.entitle
  linked. Steps only where the kit can use them; validated by the real core.
- rust.kit.entitle: recipients 'linked' (every linked player who has played
  on the server, no tally, refused past the bound), optional message ({kit})
  and delivery, stored per row (rust_perm_run_grants.notice*).
- perm.sync notices: the untold set to the picked account, keyed
  run:step:user, in the digest; the report's noticesTold marks them told.
- rust.options.grouppermissions notes a kit's permission rows via kits.uses
  (cached a minute per server; a failure is no note).
- duration: 'minutes' on rust.zone.open and rust.participation.open; the
  group-permission lease's value example is true.
- protocol 13 -> 14, coreApi ^1.13.0; ci/core-ref.json pinned to website#212's
  head while it is open; engagement-triggers.json regenerated (coreApi line).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/permissions/permissions.model.js

@@ -365,6 +365,7 @@ function buildDesired(serverId, authored) {
   // every account the user has linked (D28). The CREDIT is one extra use on the
   // account that took part, while it is still linked to the winner.
   const credits = new Map()
+  const notices = []
 
   for (const row of runGrants) {
     if (row.serverId !== serverId) continue
@@ -380,6 +381,19 @@ function buildDesired(serverId, authored) {
       const key = `${row.steamId}|${row.kit}`
       credits.set(key, (credits.get(key) || 0) + 1)
     }
+
+    // The reward's message (protocol 14, D333), to the account the reward
+    // picked, while it is still linked to the winner — and only until the
+    // plugin reports it said it. A withdrawn reward has no row, so nobody is
+    // told about a reward that is no longer theirs.
+    if (row.notice && !row.noticeToldAt && linked.includes(row.steamId)) {
+      notices.push({
+        key: noticeKey(row),
+        steamId: row.steamId,
+        message: String(row.notice),
+        delivery: row.noticeDelivery === 'popup' ? 'popup' : 'chat',
+      })
+    }
   }
 
   // ── A group's BetterChat style (phase 17, D138) ───────────────────────
@@ -415,11 +429,15 @@ function buildDesired(serverId, authored) {
     grants: [...permissionsBySteamId.entries()].map(([steamId, permissions]) => ({ steamId, permissions })),
     // Always sent, even empty (D103).
     credits: creditRows,
+    // Always sent, even empty (D333): the whole untold set, so a notice the
+    // site stops sending is one the plugin may forget.
+    notices: notices.sort((a, b) => a.key.localeCompare(b.key)),
   }
 
   const hashed = [
     ...rows,
     ...creditRows.map((c) => ({ kind: 'credit', subject: c.steamId, object: `${c.kit}#${c.count}` })),
+    ...notices.map((n) => ({ kind: 'notice', subject: n.steamId, object: n.key, value: `${n.delivery}:${n.message}` })),
   ]
 
   return { payload, rows, hash: hashRows(hashed), sources }
@@ -441,6 +459,15 @@ function isShared(group, serverRows) {
  * A digest of the desired set. Sorted before hashing, and a row's VALUE is in
  * it (a style field, a group's title, rank and parent): a change to one must push.
  */
+/**
+ * The key of one reward message (protocol 14, D333): `<runId>:<stepId>:<userId>`.
+ * One reward step tells one person once, whichever of their linked accounts it
+ * picked; `permissions.db.markNoticesTold` reads it back.
+ */
+function noticeKey(row) {
+  return `${row.runId}:${row.stepId}:${row.userId}`
+}
+
 function hashRows(rows) {
   const canonical = rows
     .map((row) => `${row.kind} ${row.subject} ${row.object}${row.value === undefined || row.value === null ? '' : `=${row.value}`}`)
@@ -561,6 +588,7 @@ module.exports = {
   buildDesired,
   retirements,
   hashRows,
+  noticeKey,
   rowKey,
   collapseGrants,
   shapeSync,