flow: keep the server's answer to a save, labelled same_screen

[abrichr]

What this does

In a browser, a save usually sends a write request and the server answers it. That answer is now kept as evidence, labelled honestly.

• PlaywrightBackend logs answers to POST/PUT/PATCH/DELETE (backends/_server_responses.py).
• The replayer marks the log before a save step's action and attaches what came back to the step: StepResult.server_responses (method, status, endpoint digest without query string, body digest and size, media type). No body, URL, header or value.
• The receipt counts them: server_responses: {observed, ok, check_level: same_screen}. The production receipt projection is unchanged.

Why same_screen, never a check

The answer comes from the same transaction as the save. A server can say 201 Created and store the wrong value, store it under another record, or roll it back. So on its own it never confirms an effect and never makes a run VERIFIED; the configured verifier still decides. A 500 behind a "Saved" banner is still worth seeing.

Results and receipts without answers serialize byte-for-byte as before (fields omitted when empty).

Tests

tests/test_server_responses.py: only write answers kept, no URL/query/body text; a real Chromium save produces one; a 201 with an unconfirmed read-back still ends RECONCILIATION_REQUIRED, not billable; the receipt counts answers without changing its evidence tier. test_run_receipt.py allow-list gains server_responses (deliberate privacy-boundary edit: counts and a fixed label only). 275 related tests pass locally.

Docs: EFFECT_KIT.md, APPROVAL_AND_VERIFICATION.md (check-level section), claims.yaml + VERIFICATION.md.

Stacked on #1280. Part 4 of 4.

🤖 Generated with Claude Code

[abrichr]

Full-diff review found 4 issues + 2 minor; fixed in the latest commit and pinned in tests/test_server_responses.py: possible hang on streaming bodies (bodies are never read now); brute-forceable endpoint/body digests (dropped: method, status, media type only); unrelated answers counted (only same-origin fetch/XHR/form writes sent after the mark; no beacons, in-flight requests or service-worker answers); redirects counted as failures (ok = status < 400); per-step cap raised to 64; caveat wording fixed.

[abrichr]

Included in batch #1384, which runs CI once for several reviewed PRs. This PR is marked merged when #1384 merges. Please don't push here unless asked; a new commit leaves it out of the batch.