feat(core-events): scaffold events optional core

Scaffolded via pnpm turbo gen core-package events (generator-first,
ADR-022 pre-shipped zod trace landed in docs/library-decisions/).
Generator wired transpilePackages + E1/J eslint rule block. Two
story-00-precedent additions so the coverage gates pass: the
@vitest/coverage-v8 devDep (L0 sweep) and the honest symbols.ts
exclude (mirroring core-shared/vitest.config.ts) plus its missing
ALLOWED_GLOBS mirror in scripts/coverage/diff.mjs (L1 gate). No
consumers wired — compile-green floor for the walking-skeleton
PRD (ADR-027).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

packages/core-events/docs/library-decisions/2026-05-14-zod.md

@@ -0,0 +1,66 @@
+---
+package: zod
+version: "^3.23.0"
+tier: core
+decision: approved
+date: 2026-05-14
+deciders: [scaffolded]
+adr: adr-015
+filter-results:
+  license: MIT
+  types: native
+  maintenance: active
+  boundary-fit: pass
+  shadow-check: pass
+  eu-residency: n/a
+  cve-scan: clean
+  named-consumer: pass
+verification-commands:
+  - pnpm audit --audit-level=moderate
+  - npm view zod license
+accepted-cves: []
+---
+
+## Filter: license
+
+MIT — on the workspace allowlist.
+
+## Filter: types
+
+Ships first-party TypeScript types in its distribution (`.d.ts` included).
+
+## Filter: maintenance
+
+Active. Regular releases by Colin McDonnell; widely adopted.
+
+## Filter: boundary-fit
+
+Core package. Zod is the workspace-canonical validation library locked in `core-shared` (ADR-015).
+
+## Filter: shadow-check
+
+Zod is already the workspace-locked validation library. No shadow.
+
+## Filter: eu-residency
+
+Pure computation; no network calls or vendor data transmission. n/a.
+
+## Filter: cve-scan
+
+No advisories at adoption time.
+
+## Filter: named-consumer
+
+`core-events` uses zod for event-descriptor payload schemas.
+
+## Prompt: replaces
+
+Nothing — zod is the pre-existing workspace validation library.
+
+## Prompt: migration-cost-out
+
+Mechanical: swap schema definitions at call sites. No data-format lock-in.
+
+## Prompt: alternatives-considered
+
+Zod is workspace-locked (see `core-shared`). A replacement would require a workspace-wide ADR; no alternative was evaluated here.