feat(sidecar): protocol 8 — three lease forwards

GET /lease, POST /lease, POST /lease/release, each a correlated round trip with cmd and reqId stamped over the caller's. lease.expired is an ordinary event. The sidecar learns nothing about keys, bounds or deadlines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

sidecar/src/main.rs

@@ -129,10 +129,19 @@ use tracing_subscriber::EnvFilter;
 /// plugin that never sends it — against protocol 6 it would read every raid as a base with no
 /// cupboard, and alert nobody while looking healthy.
 ///
+/// # Protocol 8 — the leases
+///
+/// `GET /lease`, `POST /lease` and `POST /lease/release`: an event borrowing a value and giving
+/// it back (the module's PLAN.md §27). Three correlated round trips and one event,
+/// `lease.expired`, which is filed like every other event. The allowlist, the bounds, the
+/// seven-day ceiling and the deadline timer all live in the plugin; the ledger lives on the
+/// website. This process moves lines between them and learns nothing about either, which is why
+/// the whole protocol is three thin forwards here.
+///
 /// `docs/rust-link/PROTOCOL.md` is the specification — §8 the read path, §9 identity, §10 the
-/// mirror, §11 configuration, §12 clans, §13 the raid frame; this constant is one of its four
-/// declaration sites.
-pub const PROTOCOL_VERSION: u32 = 7;
+/// mirror, §11 configuration, §12 clans, §13 the raid frame, §14 the leases; this constant is one
+/// of its four declaration sites.
+pub const PROTOCOL_VERSION: u32 = 8;
 
 fn main() -> anyhow::Result<()> {
     let args = match cli::parse(std::env::args().skip(1)) {