feat: strengthen module contracts and shared WebUI runtime

docs/AUTOMATION_CONTRACTS.md

@@ -42,8 +42,18 @@ inheritance, reuse, derivation, and automation are unavailable.
 ## Delivery Durability
 
 Domain trigger implementations persist idempotent deliveries before running.
-The existing `PlatformEvent` bus is process-local and is not a durable
-automation source. A transactional Core event/outbox bridge is still required
-to guarantee capture across commits, restarts, and multiple workers. Until
-that bridge exists, direct event ingestion must be authenticated, tenant
-scoped, and limited to public or internal event envelopes.
+`emit_platform_event` binds event delivery to the producer's SQLAlchemy
+transaction. When an enabled module provides `platform.eventOutbox`, the event
+is stored in that transaction and a dispatcher may retry it across restarts and
+workers. The Audit module provides the current SQL outbox implementation; the
+Celery `govoplan.events.dispatch_outbox` task drains it through the Dataflow
+event-ingestion capability and the local event bus.
+
+The outbox capability remains optional so reduced module combinations can
+start. Without it, Core queues events on the SQLAlchemy transaction and
+publishes them to the process-local bus only after the outer commit. A rollback,
+including a nested savepoint rollback, discards the corresponding events. This
+fallback is suitable for local or non-critical reactions, but it is not a
+durable multi-worker automation source. Deployments that rely on event-triggered
+work must enable the outbox provider and run the `events` worker queue and
+periodic dispatcher.