docs(rust): RaidableBases built (PROTOCOL §20.12, PLAN_REDESIGNS §11.4.6, D391, MODULE_API 1.16.0)

- rust-link/PROTOCOL.md §20.12: RaidableBases — hello's raidableBases, the
  five raid.* events, the tally's raidsCompleted, map.live's raids layer (and
  its §17.3 row), raid.spawn and raid.check with their refusals, the raids
  helper, the profiles in the configuration editor, the sidecar's two
  forwards and the website's step, feed, map layer and Warlord.
- modules/rust/PLAN_REDESIGNS.md: D391 (the editor's spot check is advice
  through core), §11.4.6 (what was built, the rig tests on both rigs, the
  Oxide rig's RaidableBases fault that a restart cleared, twelve points
  settled in code, the end walk's rows), and the order of work.
- website/MODULE_API.md, EVENTS.md: 1.16.0, a dry run's detail.warnings.
- website/STEAM_SIGNIN.md: its contract moves to 1.17.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

website/EVENTS.md

@@ -1812,7 +1812,7 @@ controller stamps it from the session.
 | Enablement defaulting off | Nothing that changes the world is invocable until an admin turned it on deliberately. |
 | The shard's own switches | `AdminWriteEnabled` is off by default in `Bridge.cfg`, lives on the shard host outside the website's reach, and `AdminAccessFloor` refuses any target at or above CoOwner. |
 | The ledger | Every world write is recorded with its run, step and actor, and every ledgered resource has a declared revert. Damage is attributable and, by construction, undoable. |
-| Dry run before anything unattended | **Built and enforced in Phase 6, for SCHEDULED starts only** (org lead, 2026-09-03). A version records who verified it and when; the scheduler refuses to materialise an occurrence of one that never passed, and says so once per definition per tick rather than silently. A human pressing *Start now* is not gated, because that human **is** the review the gate exists to require. A failing dry run records nothing, so it cannot unlock anything. |
+| Dry run before anything unattended | **Built and enforced in Phase 6, for SCHEDULED starts only** (org lead, 2026-09-03). A version records who verified it and when; the scheduler refuses to materialise an occurrence of one that never passed, and says so once per definition per tick rather than silently. A human pressing *Start now* is not gated, because that human **is** the review the gate exists to require. A failing dry run records nothing, so it cannot unlock anything. **A module may also advise** (MODULE_API 1.16.0, Rust PLAN_REDESIGNS §11.4, D391): a step that would run, answered `{ ok: true, detail: { warnings } }` under `verify: true`, shows each line as a **warning** finding (code `advice`) that never fails the dry run, because it describes the world as it stands now (a raid base's spot with a player on it, a rock beside it), which may change before the run. |
 
 > **Stated plainly.** The module boundary is **not** a security boundary — MODULE_SYSTEM §2.2 says so
 > explicitly, and a module runs in the same Node process with full access. None of the above defends