[emaarco]

Summary

add boundary:<trigger> --on <eventSubProcessId> attached a boundary event to an event sub-process, and validate accepted it on every platform. An event sub-process has no place in the flow to interrupt or leave, so such a boundary event is meaningless, and bpmn-js refuses the attach as well. It is now handled like a boundary event on a compensation handler.

• assertBoundaryHost (src/ops/flows.ts) refuses an event sub-process as host with E_INVALID_HOST; add --on and move --on both go through it, so nothing is written.
• checkBoundaryEvent (src/validate/structural.ts) reports an existing boundary event on an event sub-process as the structural error E_INVALID_HOST on all platforms. Because it is structural, the write gate also blocks set triggeredByEvent=true on a sub-process that already carries boundary events.
• The E_INVALID_HOST entry in src/report/guide.ts describes the new case.
• tools/iso/budget.json: the whole entry grows by 0.2 KB minified, so its budget goes from 1002 to 1003 KB.
• New tests in test/event-subprocess-host.test.ts cover add --on, move --on, validate on a loaded file and set triggeredByEvent=true.

Verified with the issue's reproduction against the built CLI: step 5 exits 2 with E_INVALID_HOST and leaves the file byte-identical; a hand-edited file with such a boundary event gets E_INVALID_HOST from validate --platform none|c7|c8 (exit 2).

Not changed: show still lists the boundary event under the event sub-process, since that is its host. Audit finding 36 in docs/audit-2026-10.md stays open because it bundles other validation gaps.

Checklist

• npm run typecheck passes
• npm run gate passes
• src/report/guide.ts and the matching page in docs/ are updated (only if a command, option or output changed)
• PR title is a changelog-worthy Conventional-Commit summary

Linked issue

Closes #75