feat(write-back): write runtimeId and the request of every monitor type [RED-991]

[sorccu]

Summary

The interactive checkly deploy write-back (#1494, #1495) listed a change to runtimeId, or to the request of a TCP, DNS, ICMP, gRPC, SSL or traceroute monitor, as not a property this tool can update. These are plain literals in the construct, and the deploy plan reports all but the SSL request under the construct's own key names, so they now get rule-table entries:

Class	Written
ApiCheck, BrowserCheck, MultiStepCheck, PlaywrightCheck, check groups	runtimeId (the classes that take one; a monitor's or agentic check's /runtimeId change keeps the generic reason)
TcpMonitor	request.hostname, port, data, ipFamily
DnsMonitor	request.recordType, query, protocol; nameServer and port written together, as the construct refuses one without the other
IcmpMonitor	request.hostname, ipFamily, pingCount
GrpcMonitor	request.url, port, ipFamily, skipSSL, timeout and the grpcConfig keys (metadata has a rule only so its refusal names the real reason: the account blanks every value)
SslMonitor	the wire shape mapped back: /request/sslConfig/{hostname,port,ipFamily} → request.*, handshakeTimeoutMs → sslConfig.handshakeTimeout, /request/sslClientCertificateId → sslConfig.sslClientCertificateId, the rest under sslConfig
TracerouteMonitor	every request key

The key lists are typed against the construct request interfaces (satisfies readonly (keyof TcpRequest)[]), so a renamed property fails the build.

One planner change: the deployed state the plan carries is the import format, which leaves out an optional key the account cleared (serverName, nameServer, data, …) while the change reports it as null. At the rule's own leaf that absence now agrees, and the property is refused with Checkly has no value for <property>; edit the property by hand instead of Checkly reported two different current values. Below the leaf the disagreement stands, since the parent would otherwise be written without the key.

Testing

plan.spec.ts: every monitor's request written (incl. the SSL mapping and a rolled-up securityBaseline), the refusals (gRPC encoding, gRPC metadata as a secret and as a blanked value, a cleared optional key, the DNS pair when one member is a variable), runtimeId replaced, inserted, cleared and refused on a monitor, and a coverage test that every key of each monitor's request has a rule. 34 tests pass; lint and tsc clean.

Stacked on #1495 (RED-986). Docs: checkly/docs#519, to merge with the CLI release.

🤖 Generated with Claude Code