feat(fabric): add tenant-wildcard comms subscribe (RIG-3107)

[rigel-mintaka]

This PR is part of a stack containing 3 PRs:

1. main
2. chore(go): raise module floor to 1.26 + absorb modernize sweep (RIG-3107) #876
3. feat(fabric): add NATS EventFabric + RunnerFabric seams (RIG-3107) #877
4. "feat(fabric): add tenant-wildcard comms subscribe (RIG-3107)" (this PR)

The T3 delivery consumer is a per-Server singleton serving every tenant, so it
must receive one event kind across all tenants. Each event publishes to a
concrete compass.<tenant>.comms.<kind>, so the singleton needs a
tenant-wildcard subscribe.

• CommsWildcardSubject(kind) builds compass.*.comms.<kind>: the tenant token
  is the literal *, the kind stays concrete and ValidSubjectToken-checked so
  a wildcard kind can never widen the subject to all kinds.
• (*Fabric).SubscribeKind(ctx, kind, fn) subscribes on that subject via one
  durable queue-group consumer, sharing the exact ack/park/teardown machinery of
  Subscribe (both now route through a private subscribeSubject helper).
  Subscribe keeps its strict concrete-only grammar; the wildcard is reachable
  only through SubscribeKind's own validated builder.
• Publish is untouched and still cannot target a wildcard: it derives its
  subject from the ref, and EventRef.valid rejects a * tenant.
• DLQ provenance + per-message logs record msg.Subject() (the concrete
  delivered subject), so a parked message on the wildcard consumer keeps its
  tenant.
• design.md's frozen EventFabric interface + SUBJECTS.md document the new
  read-side seam; the wildcard and concrete consumers are independent durables,
  so a later migration must retire the concrete subscribes rather than run both.

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-3107

[github-actions]

Compass engineering docs preview: https://compass-managed-rig-3107-fab.compass-eng-docs.pages.dev

Deployed from compass-managed/rig-3107-fabric-wildcard-subscribe at c6e90d7.

Changed pages:

• docs/designs/infra/runtime/compass-managed-multitenancy/design.md
• go/internal/fabric/SUBJECTS.md

[trunk-io]

❌ This stack was removed from the merge queue because it failed tests. PR #917 was used for testing. See more details here.

Failed Required Status	Conclusion
rollup	Failure

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here