fix: make remote run protocol validator-agnostic

[roackb2]

Summary

• accept host activity/result validators through Standard Schema V1 instead of Heddle's Zod instance
• retain synchronous host transforms while Heddle continues to own the canonical run envelope
• keep remote events JSON-safe and report the exact unsafe value path in validation issues
• update the hosted SDK examples and public docs for validator-agnostic payload schemas

Root cause

A real SlideX server using Zod 3.25 passed its schemas into Heddle 4's Zod-based codec. The foreign schema instance crashed inside Heddle's Zod 4 implementation before the host event could be validated. Heddle only needs black-box validation at this boundary, so requiring its validator implementation was an unnecessary SDK coupling.

Dogfooding also found a leaked non-JSON activity value at activity.state.trace[1].diagnostics. The strict protocol rejected it as intended; this PR now preserves the actionable path so hosts can correct their public projection.

Validation

• yarn lint
• yarn typecheck
• 110 unit files / 638 tests
• 31 integration files / 290 tests
• yarn build
• built-package /hosted and /remote import smoke
• real Zod 3.25 host-schema smoke
• real SlideX Heddle/OAuth/MCP dogfood through canonical terminal delivery and replay

Release gate

This is intentionally a draft. The downstream SlideX PRs temporarily pin commit 1a8cb3b1fe563daf58416fc41fc9158182b11c58. Do not publish npm from this PR; package segmentation and the final SlideX visual smoke remain before release approval.