[mikehostetler]

Type subscriptions currently send observations from every source and subject that has the same event kind. Add optional exact source and subject selectors for ordinary subscriptions. The existing path argument selects the type with Router exact or wildcard matching. All supplied conditions must match; omitted selectors keep the current behavior.

Bus.subscribe(bus, "inventory.stock.changed",
  selector: [source: "/warehouses/east", subject: "sku-42"]
)

Validate each selector once with Zoi and compile one of three fixed Signal pattern-matching predicates. The Router route owns that predicate. Bus delivery uses Router's index lookup directly, so normal misses return an empty target list without constructing a discarded error. Router's public error contract is preserved. Repeated outer selector options and duplicate field keys are rejected before adding state. Selected observations retain Signal identity, Router order, and target cleanup. Durable subscriptions and replay reject selectors until their stored identity and cursor rules are defined.

Add selector benchmarks for source, subject, and combined hits and misses; full Bus publication; and subscription creation and removal. Routing cases use 256 to 4,096 candidates across exact and wildcard paths. Result checks verify exact targets, record identity, delivery counts, empty mailboxes, and process cleanup. The guides explain CloudEvents context, examples, support limits, and timing boundaries.

Validation on Elixir 1.18.4 / OTP 27:

• Focused Bus tests: 63 tests, no failures. Regression tests first reproduced repeated-selector acceptance and discarded routing errors.
• Benchmark tests: 14 tests, no failures, including rejection of incorrect benchmark results.
• Full tests and tests with --include flaky --warnings-as-errors: 502 tests each, no failures; 45 excluded.
• Coverage: 96.5% total; selector module: 100%.
• mix quality: formatting, compilation, Doctor, ExDoc, Credo, and Dialyzer pass.
• Property and fuzz suites: 45 tests each, no failures; 440 property inputs and 6,000 fuzz inputs. Reports have no missing contracts in the selected suite.
• Benchmark smoke and scale profiles: 150 and 369 cases pass; these include 18 and 27 selector cases. No owned processes remain. Timings are local measurements, with no fixed performance budget.
• mix deps.unlock --check-unused and mix hex.build pass. Benchmarks and generated reports remain outside the Hex package.
• mix hex.audit reports the existing Decimal 3.1.1 advisory EEF-CVE-2026-97853, tracked in fix(v3): update the vulnerable Decimal lock dependency #215. The separate dependency PR fix(deps): update Decimal lock to 3.2.0 #218 fixes it. This PR does not change mix.lock.

Closes #214

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}