fix(headless): keep Harbor archive ids within ref grammar

[me2seeks]

Summary

Harbor's archive writer could produce an artifact id that the Runtime resource parser rejects: = was allowed by the writer but not the parser, and three independently truncated segments could exceed the parser's 160-character limit.

This keeps the Runtime parser as the protocol authority and changes only Harbor's writer:

• retain readable 40-character session and runtime-event prefixes;
• sanitize prefixes to the Runtime grammar;
• append a full SHA-256 over the untruncated sessionId, runtimeEventId, and bodySha256;
• keep the existing reader validation unchanged for legacy replay compatibility.

The maximum generated id is 153 characters. Distinct opaque ids that differ only after the readable prefix also remain distinct on disk.

Verification

• biome lint on both changed files
• npm --workspace @maka/headless run typecheck
• focused writer-to-parser regression: 2 passed
• existing Harbor archive/ArchiveRead coverage: 8 passed
• complete Headless suite: 1387 passed, 5 skipped, 0 failed

Closes #2036

简体中文

Harbor 旧 writer 允许 =，并分别截断三个 segment；生成的 artifact id 可能含有 Runtime parser 不接受的字符，也可能达到 217 字符，导致文件已经写入、resource ref 却无法解析。

本修复不放宽 Runtime 协议，只收紧 Harbor writer：保留 session/runtime event 的 40 字符可读前缀，并在其后附加基于完整未截断 identity 的 SHA-256。最终长度最多 153 字符；两个只在前缀之后不同的 opaque id 也不会因截断写到同一路径。旧 reader 的兼容校验保持不变。

新增测试通过真实 Harbor writer 归档，再调用真实 Runtime ref builder/parser，分别覆盖 =、超长输入和截断碰撞。

[Astro-Han]

Thanks for keeping the Runtime parser as the protocol authority and tightening the Harbor writer at the source. The generated ID stays within the grammar and length bound, while hashing the complete untruncated identity prevents prefix truncation and sanitization collisions. The writer-to-parser regression covers the original failure path well. Ready to merge. Approving.