feat(event-bridge): WP-0003a — domain model, rules module, event type registry

Implements phases 7–8 of the Event Bridge architecture (custodian-WP-0003a).

Domain model (T34, T40):
- Added RuleDef, InstructionDef, ActionDef to models.py
- Updated ActivityDefinition with rules/instructions fields (task_templates deprecated)
- Formalized EventEnvelope: id, type, version, timestamp, publisher, attributes
- Added from_nats_message() and from_webhook_payload() classmethods

Rules module (T35, T36, T37):
- src/activity_core/rules/ skeleton with boundary enforcement
- evaluate_condition() — sandboxed AST walker, whitelisted nodes only, never exec()
- execute_instruction() — LLM task generation with trusted_fields injection guard
- tests/rules/test_boundary.py verifies no cross-boundary imports

Infrastructure (T38, T39):
- Alembic migrations 0004 (task_spawn_log) and 0005 (event_types)
- IssueSink ABC + IssueCoreRestSink (REST) + NullSink (testing)
- TaskSpawnLog and EventType ORM models

Event type registry (T41, T42, T43):
- event_type_registry.py: file scanner, parser, DB sync, in-process lookup
- ACTIVITY_CURATOR_GATE env var (disabled|required) + approve endpoint
- Three org event type definitions: org.repo.registered, org.workstream.completed,
  org.activity.run.completed

All 10 tests pass. Boundary test confirms rules/ isolation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_event_router.py

@@ -34,13 +34,11 @@ def _make_envelope(
     payload: dict | None = None,
 ) -> EventEnvelope:
     return EventEnvelope(
-        event_id=str(uuid.uuid4()),
+        id=str(uuid.uuid4()),
         type=event_type,
-        source="test-service",
-        occurred_at=datetime.now(tz=timezone.utc),
-        subject="user/123",
-        trace_id=str(uuid.uuid4()),
-        payload=payload or {},
+        publisher="test-service",
+        timestamp=datetime.now(tz=timezone.utc),
+        attributes=payload or {},
     )
 
 
@@ -122,7 +120,7 @@ async def test_dispatch_starts_workflow_with_correct_id() -> None:
 
     await router._dispatch(activity_id, envelope)
 
-    expected_id = f"activity-{activity_id}:{envelope.event_id}"
+    expected_id = f"activity-{activity_id}:{envelope.id}"
     temporal_mock.start_workflow.assert_called_once()
     call_args = temporal_mock.start_workflow.call_args
     assert call_args.kwargs["id"] == expected_id
@@ -271,12 +269,10 @@ async def test_publish_event_starts_workflow(integration_skip: None) -> None:
     # Publish a matching event.
     event_id = str(uuid.uuid4())
     envelope = EventEnvelope(
-        event_id=event_id,
+        id=event_id,
         type=event_type,
-        source="integration-test",
-        occurred_at=datetime.now(tz=timezone.utc),
-        subject="test/1",
-        trace_id=str(uuid.uuid4()),
+        publisher="integration-test",
+        timestamp=datetime.now(tz=timezone.utc),
     )
 
     nc = await nats_lib.connect(NATS_URL)