docs(runicnpc): stage 7 built and walked; API 6 and the dropLoot switch

- runicnpc/API.md: version 6, the profile's loot block and a spawn's
  loot.dropTable override.
- rust-link/PROTOCOL.md: §19.15, world.place's dropLoot.
- runicnpc/PLAN.md: stage 7's "Built" section. It covers the builds it
  was tested on (Rust 25681086, Oxide 2.0.7801, Carbon 2.0.262), the
  harness (s7 25/25, all 270/270, both rigs) and the walk on both rigs
  through the site. It also lists what building it found: Rust's
  ApplyLoot after the hook, and the inventory already emptied when the
  hook runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

rust-link/PROTOCOL.md

@@ -2582,3 +2582,23 @@ Stage 6's wire changes **join protocol 13** while it is unreleased (D282); no me
 `rust.boss.killed` (ceiling `everyone`, default `subscribers`) for app, in-app and email rules; Discord hears
 a boss only through an event's announce step (D277). The feed shows a boss appearing, and its death where the
 server's presence setting allows. The profile form gains the boss box and the passive role.
+
+### 19.15 RunicNPC stage 7: loot (runicnpc PLAN.md stage 7)
+
+Stage 7's wire change **joins protocol 13** while it is unreleased (D299); no message changes shape, and
+`PROTOCOL_VERSION` stays 13. The bridge now needs **RunicNPC API 6**: `RunicNpcApiNeeded = 6`,
+**`runicnpc_api = 6`** in `overlay.toml`.
+
+**A profile's `loot` block** travels in `npc.profiles` and `npc.profiles.set` as RunicNPC holds it (runicnpc
+`API.md`); the bridge reads none of it.
+
+**`world.place` with a `profile` takes `dropLoot`** (D296), optional:
+
+```json
+{"cmd":"world.place","runId":"42","key":"…","profile":"bandit","count":4,"server":"main","x":880,"z":-1850,
+ "dropLoot":false}
+```
+
+`false` spawns the NPCs with RunicNPC's override `{"loot":{"dropTable":false}}`: they keep what their profile
+starts the corpse with, and roll no loot table. Absent or `true`, as before. The site sends it only when an event's
+Place NPCs step switches it off.