feat(bridge): protocol 8 — the leases (PLAN.md §27)

lease.list / lease.apply / lease.release and a lease.expired event. The plugin holds the allowlist (decay.scale, 18 populations, the two minimum spawn scalars, and group permissions), the seven-day ceiling (refused, never clamped) and the deadline, which it enforces on its own. Release is compare-and-set. Holds persist in the data directory with their boot: a restart ends a convar hold, while a group-permission hold survives it and is re-armed.

EventsEnabled (default off) gates apply only, and a write from the site's config editor now takes effect at once. The permission mirror defers to a leased pair: it is reported as leased, never foreign.

Grants pass a null owner: with an owner, Oxide silently refuses any permission another plugin registered.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

overlay.toml

@@ -26,10 +26,10 @@
 # the same change that alters the emitters, exactly as the sidecar bumps
 # PROTOCOL_VERSION and the module bumps its own constant.
 #
-# Current: 7 — the transport, the read path, identity, the permission mirror,
+# Current: 8 — the transport, the read path, identity, the permission mirror,
 # configuration from the site, first-party clans, and a raid frame that names who
 # lives there (docs/rust-link/PROTOCOL.md §13).
-protocol = 7
+protocol = 8
 
 # ── Oxide compatibility ──────────────────────────────────────────────────────
 #