Event names are local now, in the manifests and in the code

Every module named its events the way the old bus spelled a routing key —
`module.<module>.<verb>`. Design 29 says a module names an event locally and the
mesh works out where it lands, so all 37 were stale against a rule already
decided. On the new bus that derives into a namespace belonging to a module
called "module", so no cross-module subscription in the mesh matched anything:
nothing failed, nothing reacted (novox/hq 04-ISSUES/127).

36 manifests converted, and 43 files of module code with them. The code mattered
as much as the manifests: the runtime builds the subject from what `emit()` is
handed, so a converted manifest with unconverted code would have had the
permission and the subject disagree.

Three things the new check found on the way:

- `photos` emitted an event its manifest never declared, which the new bus refuses
  outright. Declared.
- `showcase` waited for an event nothing emits, so its demo could never be
  triggered — only `showcase` may publish under its own name. It emits both halves
  now.
- `distribution` declared an event named after a different module. It emits
  `image.pushed` under its own name. An event about a *role* belongs on the seat,
  where the name outlives whoever holds it, but the sdk has no way to publish on a
  seat yet, so that stays recorded rather than declared.

The audit logger's "everything" pattern is `**` rather than the old bus's `#`.

modules/keycloak/index.ts

@@ -28,17 +28,17 @@ async function announce(type: string, body: Record<string, unknown>): Promise<vo
 
 export const events = {
   userCreated: (realm: string, username: string, email?: string) =>
-    announce("module.keycloak.user.created", { realm, username, ...(email ? { email } : {}) }),
+    announce("user.created", { realm, username, ...(email ? { email } : {}) }),
   userDeleted: (realm: string, userId: string) =>
-    announce("module.keycloak.user.deleted", { realm, userId }),
+    announce("user.deleted", { realm, userId }),
   passwordReset: (realm: string, userId: string) =>
-    announce("module.keycloak.password.reset", { realm, userId }),
+    announce("password.reset", { realm, userId }),
   clientCreated: (realm: string, clientId: string, name?: string) =>
-    announce("module.keycloak.client.created", { realm, clientId, ...(name ? { name } : {}) }),
+    announce("client.created", { realm, clientId, ...(name ? { name } : {}) }),
   groupCreated: (realm: string, name: string) =>
-    announce("module.keycloak.group.created", { realm, name }),
+    announce("group.created", { realm, name }),
   roleCreated: (realm: string, name: string) =>
-    announce("module.keycloak.role.created", { realm, name }),
+    announce("role.created", { realm, name }),
 };
 
 console.log("[keycloak] event surface ready — identity, client, group and role changes are announced");

modules/keycloak/module.json

@@ -25,12 +25,12 @@
     "container-runtime"
   ],
   "emits": [
-    "module.keycloak.user.created",
-    "module.keycloak.user.deleted",
-    "module.keycloak.password.reset",
-    "module.keycloak.client.created",
-    "module.keycloak.group.created",
-    "module.keycloak.role.created"
+    "user.created",
+    "user.deleted",
+    "password.reset",
+    "client.created",
+    "group.created",
+    "role.created"
   ],
   "listens": [
     {