Railbase core v0.5.8

Data-resident plugins gain a UI and cross-plugin symbiosis — a downloaded core now serves a site at / and renders an installed plugin's pages with no rebuild.

• Site shell at /: the core embeds + serves a Preact/Tailwind site (login is settings-driven from the enabled auth methods; a launcher lists installed plugins). An embedder's own ServeStaticFS("/") still wins.
• Plugin UI on install: a plugin ships a widget descriptor; the core serves it (license-gated) at GET /api/plugins/{slug}/ui and the shell renders it at / — table/list/form/upload widgets bound to the plugin's own verbs (auth + tenant enforced server-side). Install refuses a colliding/reserved mount; nothing is codegen'd into customer files.
• Cross-plugin symbiosis: $app.onEvent(topic, fn) (consume, per-event VM) + $app.emit(topic, payload, tenant) — a data-resident plugin can react to and drive domain events.

Binaries pin the vendor key set + lock the marketplace to railbase.app. Verify downloads against checksums.txt.