fix(headless): teach the trajectory exporter the two envelope fields it never learned

[Astro-Han]

What

Every Maka cell of the #2245 two-arm run exported a one-line summary in place of its trajectory — 89 of 89, all with maka_summary_reason: runtime_event_schema_invalid. Codex exported 89 of 89 complete, 15 to 184 steps each.

That means any analysis built on the normalized ATIF trajectory is blind on our own arm, which is how this surfaced: it is the data source a contamination detector would read.

Refs #2245

Root cause

maka_trajectory.py's _is_runtime_event validates the RuntimeEvent envelope against a hand-copied key whitelist and rejects any event carrying a key it does not list. The runtime's envelope gained origin and modelVisibility; the whitelist never learned them.

Replaying the run's own runtime-events.jsonl, all 89 files fail at the same shape, and always with the same two keys:

89 files, 89 rejected — extra keys: modelVisibility, origin
first: adaptive-rejection-sampler, event 4 of 507
  { ..., "role": "model", "author": "agent",
    "origin": "provider", "modelVisibility": "visible", ... }

Both are legitimate optional envelope fields — RUNTIME_EVENT_SHAPE in packages/core/src/runtime-event.ts lists them, and defineObjectShape<RuntimeEvent>() type-forces that list to cover the interface. Only the Python copy could drift, and it did. In this corpus the values are only ever provider/visible or absent, so nothing semantic was lost — the events were simply refused.

Why the existing guard missed it

Core's decoder and the Python exporter already share one validation corpus (runtime-event-validation-corpus.json), run from both sides. It did not catch this because the corpus is a hand-written list of cases: 52 of them, and four envelope keys — origin, modelVisibility, branch, status — set by none of them. It covered the keys someone thought to write cases for.

So the fix is in two parts:

• maka_trajectory.py accepts both fields with the value constraints the TypeScript decoder applies (provider/code_mode, visible/hidden).
• The corpus covers all four previously unexercised keys, accepted and rejected, and a new Core test holds the corpus to runtimeEventEnvelopeKeys(). TypeScript already forces that list to cover the interface, so the chain is now: interface → shape → corpus → Python. A field added without a case fails in Core rather than silently blinding a benchmark run.

Verification

Replaying all 89 cells' real runtime-events.jsonl through the exporter, with the run's own status and runtime refs:

	before	after
full trajectory	0	78
runtime_event_schema_invalid	89	0
image_artifact_metadata_missing	0	11

Recovered trajectories run 9 to 252 steps (median 26).

The 11 remaining cells carry image content whose artifact metadata resolves against a trajectory-state store that is not present in any of the 89 exported cells, so this corpus cannot say whether those 11 would have exported fully in production — a different reason code and a separate question.

Red/green, both directions:

• Removing the two keys from the Python whitelist again → the corpus-driven Python test fails on valid-provider-origin.
• Removing the origin corpus cases → the new Core test fails with no corpus case sets the envelope key origin.

npm run -w @maka/core test — 796 pass. npm run -w @maka/headless test — 1421 pass. Lint and format clean.