feat(bridge): the world verbs an event owns (protocol 7, Phase 12a)

Five verbs an author sees -- creatures, an enhanced "boss", an oracle NPC, a
temporary gate, decoration -- and ONE command family underneath them, because
every one of them ends in the same sentence: an object exists, and this run
owns it. `world.spawn` / `world.despawn` / `world.owned` carry a `what`
discriminator, and the per-verb differences are fields rather than kinds.

The ownership registry is PERSISTED, and that is forced rather than chosen. A
spawned creature is in the world save, so it survives the restart that proves a
town-crier line gone -- which already rules out reconcile-by-boot-stamp. But the
record of which run owns which serial has nowhere else to live: in memory it is
lost in the restart the creatures survive, and only in the website's ledger it
is not held here at all, so `world.despawn` would delete whatever serial it was
handed and "never touches a creature it did not create" would have no mechanism
behind it. So the Bridge gains its second persisted file beside
`Participation.bin` -- written by the same world save as the objects it
describes, so the two cannot get out of step.

The oracle is ours rather than `XmlSpawner2.XmlDialog`'s, and that engine is the
reason for both halves of the decision. Its `SpeechEntry` is the evidence the
shape is right -- `Text` plus comma-separated `Keywords`, a keyword-less entry
as the greeting, a proximity range, a conversation lock. It is also why not to
build on it: `SpeechEntry` carries an `Action` string, XmlSpawner's
command-scripting language, which would leave an arbitrary-command field one
step from an event author. `Mobile.OnMovement` (delivered to every mobile in
range -- the `HandlesOnMovement` filter applies only to Items) and
`Mobile.HandlesOnSpeech`/`OnSpeech` are native virtuals and are all it needs.

Every `Bridge.EventsMax*` REFUSES rather than clamps, on `LeaseMaxDurationSec`'s
argument from 11b: the shard's bound exists for the case where the website is
wrong. `Bridge.EventsEnabled` gates all of it -- spawning is the same consent
11b introduced that switch for, not a third one.

Decoration carries an `itemId`, because `Static` accounts for 5031 of the tree's
decoration placements under 1992 different graphics: for that class the graphic
IS the identity. Never applied to a `BaseAddon`, whose own ItemID is not what a
player sees. Containers are refused outright -- teardown would delete whatever a
player had left inside.

`tools/scaffolding` gains `worldgone <serial>`, which deletes an object behind
the registry's back. It is the one outcome the rig cannot reach by asking the
bridge -- every bridge verb that removes an object also drops its row -- and it
is what a player's sword does every time they kill an event creature.

Verified on a real ServUO 57.4 world (206k items, 42k mobiles) against the
release sidecar: all five verbs place; every ceiling refuses; a container and an
unknown type refuse; one run cannot despawn another's object; the registry and
its objects both survive a save and a clean restart (`pruned: 0`); a creature
deleted behind the registry's back comes back `gone` rather than `removed`; and
a five-second gate is collected by the shard's own deadline with `world.expired`
on the wire.

Refs: docs/link/v7.md, docs/website/EVENTS_PLAN.md Phase 12a

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

overlay/Config/Bridge.cfg

@@ -239,6 +239,49 @@ ParticipationMaxRadius=300
 ParticipationGraceSec=86400
 ParticipationSnapshotChunk=100
 
+# ---- The world verbs (protocol 7) ----------------------------------------------------
+# What an event may PLACE in the world, all of it owned by the run that placed it and
+# deleted when the run tears down. Every ceiling here REFUSES rather than clamps: this
+# shard's bound exists for the case where the website is wrong, and a quiet clamp would
+# leave the two halves disagreeing about what was actually placed.
+#
+# The defaults are the EM Program's published quotas, because they are the only numbers
+# anyone has defended in public.
+
+# Per CALL: creatures, enhanced "boss" variants, oracle NPCs and decoration items.
+EventsMaxCreatures=30
+EventsMaxBosses=4
+EventsMaxNpcs=5
+EventsMaxDecor=60
+
+# The longest a temporary gate may stand. The shard closes it on its own when the time
+# passes, whether or not the website is ever heard from again.
+EventsMaxGateMinutes=240
+
+# Per RUN, across every verb above. The per-call ceilings bound one request; this bounds
+# a run that calls a verb in a loop, which is the shape a runaway schedule takes.
+EventsMaxOwnedPerRun=200
+
+# How far from the chosen spot things may be scattered.
+EventsMaxSpread=40
+
+# How much harder than normal a "boss" may be made. EVENTS.md calls it an enhanced
+# regular mob, so this is low enough that the result is still the creature that was
+# picked.
+EventsMaxBossMultiplier=10.0
+
+# The oracle NPC: how many keyword lines it answers to, how close a player must be to be
+# greeted and to be heard, and how often it will speak to the same player.
+EventsOracleMaxLines=5
+EventsOracleGreetRange=4
+EventsOracleSpeechRange=8
+EventsOracleGreetCooldownSec=60
+EventsOracleAnswerCooldownSec=5
+
+# How often expired gates are collected and rows for objects the world has already lost
+# are pruned.
+EventsSweepSeconds=30
+
 # The test scaffolding in tools/scaffolding/ reads its own flags from this file
 # (SeedOnStart, CensusOnStart, ProbeOnStart). They are absent here on purpose:
 # Config.Get returns the default of false when a key is missing, so a deployed