fix: preserve actionable safe factory failure evidence

[walker-tx]

Summary

Follow-up to #206, related to #203 and failed run 34284810641.

• Accept Kit 0.1.130's storage_status event only with its exact boolean fields. Malformed and unknown events still fail closed.
• Retain bounded, allowlisted error categories/codes and available byte-span/retry details for recognized Runlet, tool-schema, and ACP handshake failures.
• Summarize nested subagent completion/output types and ACP tool statuses without publishing raw output.
• Preserve some late-session evidence when source/event limits are exceeded.
• Add regression tests and document source formats and limits.

Safety and limitations

No raw error prose, prompts, reasoning, arguments, identifiers, URLs, or stdout/stderr content is exported. Unknown errors are explicitly marked as omitted.

Kit 0.1.130 does not persist a definitive subagent output-schema validation verdict; the artifact reports schema_validation: not_observable rather than inventing one. Recognized tool-schema failures remain distinguishable. Source formats were checked against public v0.1.130 source and its pinned dependencies; tests use synthetic fixtures, not live sessions.

This fixes a reproduced diagnostics-parser bug, not the still-unknown cause of Okta's technical-research failure. No Okta retry or live Actions verification performed.

Validation

• All 14 factory test suites passed.
• Exact storage_status event from the failed run accepted; malformed variants rejected.
• Container-entrypoint fixtures cover storage events followed by retained child events and detailed schema errors.
• Secret-canary, nested-error/outcome, and late-evidence retention tests passed.
• Guidecheck and lint-guide package tests passed.
• ShellCheck 0.10.0, Actionlint 1.7.12, and git diff --check passed.
• Go checks used Go 1.24.13 locally to avoid the existing macOS Go 1.22 dyld issue.
• Independent review found no blockers.