fix(runtime): judge and persist realization concerns through portable payloads

[doublewhy]

Summary

Snapshot admission accepts tuple, enum, dataclass and model carriers in entry payloads; the SEM-218 disclosure readers and sanitizer that run next read JSON objects and arrays only. Up to dev cf8b4308, a registered concern inside a carrier was misjudged or committed raw:

• closed runtime-environment excess in a spec wrapped in an Enum member or dataclass committed with success;
• an open observation in such a spec was committed raw ("value": "production", no provenance row);
• an exact observation inside a carrier was refused.

Both now read the portable JSON projections of the plan's and result's payloads (as snapshot_values_equal does), so a registered concern is judged and persisted identically as a plain mapping or inside an admitted carrier whose portable serialization keeps every field admission walks under the same name and value. Plain-mapping results commit what they did before.

Requirement UIDs

• SEM-218 (Explicitness And Realization Semantics). Per the Carry resolved realization posture through the backend-facing plan #1067 preflight (item 8), closed excess is a backend-contract failure, checked before accepting or persisting. As in feat: carry resolved realization authority through plans #1081, no scope file or record change.

Related Issues

Closes #1451

Follow-ups: #1502 (model fields the serializer excludes, renames or rewrites), #1518 (credential and prepared-node boundaries).

ADR Impact

• None. Readers, sanitizer and rules are unchanged.

Changes

• backend_apply_results.py:_portable_payloads projects payloads via to_jsonable_python; _realization_disclosure_result runs both disclosures over them.
• _safe_realization_snapshot sanitizes the same projection; an entry keeps the backend's representation when it serializes to its sanitized view (a tuple returned as planned stays a tuple), else the sanitized view is committed.
• A planned tuple returned as JSON is now admitted, but planner/ordering._entry_matches_resource still re-plans the three domain resources as UPDATE; one returned as planned re-plans as UNCHANGED.
• Research evidence collected with collect_research_evidence.py on source 71e86070 (dev 348c4903, clean): 6 pinned artifacts through the production pipeline (42 stage results: 38 passed, 4 preregistered non-execution); 10 retained SDL cases replayed, 4 production cases and 14 participant functions run (18 passed); all 20 formal observations as expected. Recorded with python -m tools.research_capture record (templates c9ca186a / 3bad3945): capture-55f3cb3a…, capture-36481077…. Drift: versions.python 3.12.3 (was 3.11.15); formal commands[0] is the retained-case-replay argv that ran.

Issue's Verification Plan bullet (verbatim)	Change	Test failing without it	CI lane	Run
the reference provisioner returns the web node's spec with closed runtime-environment excess as a plain dict, an Enum member or a dataclass. All three are refused with runtime.backend-contract-invalid, and the snapshot stays empty. An honest apply is still admitted.	_realization_disclosure_result	test_closed_runtime_environment_is_refused_inside_a_carrier_that_serializes_it (enum-member, dataclass); test_honest_apply_is_admitted pins	test-shard	38498469224
the issue #985 safe-projection case, for an exact and an open runtime environment, with the returned spec as a plain mapping, an Enum member or a dataclass, and with the environment value itself wrapped. Each is admitted, commits the same portable payload and provenance as the plain mapping, and never commits production or the description annotation.	_safe_realization_snapshot	test_only_the_safe_projection_persists_inside_a_carrier_that_serializes_it (6 carrier cases)	test-shard	38498469224
the stub target applies a planned domain-topology tuple that its provisioner returns as planned or as JSON. Both are admitted.	_portable_payloads	test_planned_tuple_matches_the_same_value_returned_as_json[returned-as-json]; test_tuple_returned_as_planned_is_committed_as_returned_and_replans_unchanged	test-shard	38498469224
the carrier cases and the JSON case fail on dev before the fix.	all rows	9 cases, dev's file	local	Test Plan

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

pytest <new module>: 15 passed. With dev's backend_apply_results.py: 9 failed (exactly the carrier cases and returned-as-json), 6 passed. With the sanitized view always committed (before the rebase), only the re-plan test failed.

45 SEM-218 modules: 686 passed (+1 integration). 158 raes_runtime modules: 3587 passed, 2 skipped (43 integration). 82 backend and conformance modules: 2075 passed (22 integration). Docker tests: CI integration-docker. tools/check_specification_coverage.py and tools/check_formal_semantic_validation.py exit 0 at the head and on git merge-tree --write-tree origin/dev HEAD. nox -s verify-fast-feedback -- --base-rev origin/dev and nox -s lint passed.

CI on head be2c827a (dev base 348c4903): all 28 checks passed, 1 skipped; canonical run 38498469224 (21 jobs succeeded).

Ground Control Checks

• Repository policy command passes
• Pre-push code review and test-quality review completed, or not run for this lane

make policy passed; test quality: the fail-without-change run.

Traceability

• IMPLEMENTS: SEM-218 ← implementations/python/packages/raes_runtime/backend_apply_results.py
• TESTS: SEM-218 ← implementations/python/tests/test_issue_1451_portable_disclosure_payloads.py

Checklist

• Code follows the project coding standards
• FM2 (portability rule between layers). I1: plain mapping and carrier are judged and persisted identically (differential tests). I2: every committed entry serializes to the judged sanitized view; one that already does is committed unchanged (re-plan test).
• Published contract schemas regenerated if models changed: no model or schema changed.
• PR title is a Conventional Commit (release-please derives the version and CHANGELOG.md from it)
• Architectural docs updated if applicable: not applicable.