feat(events): gate shared-dev consumer mode changes

Add ValidateOpsCutover, eventmode CLI, and a host script that pin agent_system_dev and refuse FAV plus test/main before any cluster mode write.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/event-consumer-mode.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Shared agent-dev event consumer mode switch.
+# Only environment=dev, consumers notify|workflow_advance|projection, modes off|shadow|live.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+ENV_FILE="${EVENTMODE_ENV:-configs/.env.dev}"
+
+usage() {
+  echo "usage: $0 inventory | set <consumer> <mode> | quarantine-illegal" >&2
+  exit 2
+}
+
+if [[ $# -lt 1 ]]; then
+  usage
+fi
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "event-consumer-mode: missing $ENV_FILE" >&2
+  exit 1
+fi
+
+if grep -E -q '^ENV=(test|main)[[:space:]]*$' "$ENV_FILE"; then
+  echo "event-consumer-mode: refusing test/main env file" >&2
+  exit 1
+fi
+
+# Host-side ops pin the published dev database; never test/main ports.
+export CONTEXT_DB_HOST="${CONTEXT_DB_HOST:-127.0.0.1}"
+export CONTEXT_DB_PORT="${CONTEXT_DB_PORT:-5433}"
+export CONTEXT_DB_NAME="${CONTEXT_DB_NAME:-agent_system_dev}"
+export ENV=dev
+export EVENTMODE_ENV="$ENV_FILE"
+
+case "$1" in
+  inventory)
+    go run ./cmd/eventmode inventory
+    ;;
+  set)
+    if [[ $# -ne 3 ]]; then
+      usage
+    fi
+    consumer="$2"
+    mode="$3"
+    if [[ "$consumer" == "fav" ]]; then
+      echo "event-consumer-mode: fav is disabled" >&2
+      exit 1
+    fi
+    go run ./cmd/eventmode set "$consumer" "$mode"
+    ;;
+  quarantine-illegal)
+    go run ./cmd/eventmode quarantine-illegal
+    ;;
+  *)
+    usage
+    ;;
+esac