feat(events): implement Phase 22 durable event runtime

[404khai]

Phase 21 preserves outbox obligations but does not deliver or process them. Phase 22 adds a local asynchronous PostgreSQL event runtime: publisher and consumer crashes redeliver the original identity/body while inbox recognition and local effects commit atomically.

• Add roadrunner-events with Tokio polling, blocking SQL workers, source-ordered immutable transport, separate transport/application acknowledgements and role exclusion.
• Add checked fact projection and local notification consumers, original inbox outcomes, independent business-effect recognition, gap deferral, retained quarantine and fingerprint/principal/reason-bound reconciliation.
• Preserve acknowledged publisher/consumer progress with independent fsynced role anchors and immutable receipt ancestry; uncertain commits stop the writer and require exclusive restoration.
• Replay recorded message attempts, ordering and approved skips in isolated memory; verify outcomes/cursors/effects/projection without emitting SQL or external effects. Add live read-only backlog inspection and structured tracing.
• Apply additive checksum-pinned migration 0002_events.sql without changing the original operational checkpoint, namespace or anchor format. Preserve the operational command/observation boundary and update its OpenAPI description.

Validation: formatting and strict workspace Clippy pass; 234 workspace tests pass. Seven real event-storage tests and all five Phase 21 storage tests pass. Five actual event-process histories cover SIGKILL around append, transport ACK, partial effect/inbox COMMIT and delivery ACK, plus live asynchronous delivery, exclusion, inspection and graceful shutdown. All seven Phase 21 process cases also pass against the new schema. CI explicitly runs the real database/process suites sequentially.

Recorded release evidence contains 30 raw delivery samples with hardware/dataset/build/configuration and median/p95/p99. It includes psql observation/polling overhead and full retained-content hashing, so it is a local baseline without production latency/scalability claims.

The selected transport is a local PostgreSQL stream; no broker dependency is needed for this scope. Notifications are local durable obligations, with no remote sending or end-to-end exactly-once claim. Automatic event-triggered dispatch, physical observations from integration events, public remote-source input, parallel consumers, automatic failover and writable physical clones remain unsupported.

Deployment: stop writers, run the offline migration, retain an absolute ROADRUNNER_EVENT_ANCHORS directory independently of DB backup rollback, then run roadrunner-events --run <world-key>. See docs/events.md, docs/phase-22-completion.md and docs/evidence/phase-22-verification.json for contracts and evidence.