[rennf93]

Summary

Closes GAP-P4 (four event constants without emitters) and V3 (the missing send_cloud_detection_events bus method) from the PHP-family feature matrix.

• EventBus::sendCloudDetectionEvents, the reference middleware_events.py port: the cloud_blocked verdict event (handler cloud, action request_blocked or logged_only in passive mode, the provider and network metadata) plus, when a forwarded route blocks clouds, its access_control decorator_violation.
• The cloud_provider check emits the bus cloud events on every block path and its own block_clouds decorator_violation for a route-level block - the reference check passes a null route to the bus for exactly that case.
• The ip_security check's country stage emits country_blocked (handler ipinfo, the reference allowlist and blocklist reasons with the country and rule_type metadata) and geo_lookup_failed (a failing resolver reports the lookup failure and a miss, never a raise, mirroring get_country's internal catch).
• security_headers_applied emits behind the reference security-headers TTL cache (TTLCache(1000, 300) semantics: one event per config+path per window keyed cfg_{id}path{sha256 prefix}, empty paths gated, oldest-first trim matching the single-TTL eviction order), at the pipeline pass (the headers the adapter applies to the pass-through response) and on blocked responses.
• The events also close the H3 and H6 event-deferral notes and give DynamicRuleManager.matchEvent a live cloud_blocked stream to correlate against.

Tests

• bin/test_events_parity.php (55 assertions): the bus method (hit, miss, passive, route decorator), the cloud check through the engine (global and route-level), the country events (blacklist, whitelist, pass, failing resolver), and the headers event (first emission, TTL-window dedupe, distinct paths, blocked responses, the 1001-path eviction flood, empty path, disabled headers).

Gates

• composer validate, composer audit --locked, php -l sweep, every bin suite plus all conformance runners green (no stale xfail baseline), coverage gate PASS (every executable line covered or provably unreachable).