feat(write-back): hold the rule table to every construct prop at build time [RED-992]

[sorccu]

Summary

The write-back rule table (services/write-back/plan.ts) was a hand-written list per construct class: a prop added to a construct silently got the generic not a property this tool can update reason. #1496 guarded the request interfaces at compile time; this extends the guard to every props type behind the table.

• Each class's written keys are as const lists typed with satisfies readonly (keyof XProps)[], and the identity rules are built from them.
• A build-time assertion holds every props type (CheckProps, RuntimeCheckProps, MonitorProps, the props of all 13 check and monitor classes, both groups, ApiCheckDefaultConfig) to its class's written list in both directions: every key is written or named in one of the reasoned allow-lists (ReferenceKey, ContentKey, BundleKey, LocalOnlyKey, NotWrittenKey, GroupMemberKey, NotYetKey), and every written key exists on the props. Adding a prop to a construct now fails tsc until the rewriter writes it or names why it does not.
• WRITTEN_BY_CLASS exports the same lists so a spec holds RULES_BY_CLASS to them (per class, the non-companion top-level targets equal the written list).

Building the lists surfaced three props that are plain literals the account reports under the construct's own name, which now get rules: sslCheckDomain and aiAutoRepairEnabled on BrowserCheck, aiAutoRepairEnabled on MultiStepCheck, prompt on AgenticCheck. triggerIncident gets its own reason (Checkly does not report the incident trigger's settings; edit it by hand), since the deployed state the plan carries holds only the flag while the change reports the trigger's settings.

Writing prompt needed one renderer change: a multi-line string replacing a template literal is written as a template literal (backslash, backtick and ${ escaped) instead of a one-line quoted string, so a prompt or description keeps the author's form. A value holding a control character other than LF or TAB falls back to the quoted form, because a template normalises CR and CRLF to LF and the file would not read back as the same value.

Left out on purpose

playwrightConfig (the account nulls its credential sections through object-kind redactions, and a check usually inherits it from the project config, which an insert would pin), engine (one object sent as two leaves) and agentRuntime (holds a set) are named as not written yet and tracked as a gap.

Testing

plan.spec.ts: per-class equality of the rule table with the written lists; the new literal props written, playwrightConfig and triggerIncident refused with their reasons; a multi-line prompt rewritten as an escaped template literal, a single-line one quoted, a CRLF one quoted. literal-edit.spec.ts: the template-literal escaping and refusal. 87 write-back tests and the full suite pass; lint and tsc clean.

Stacked on #1496 (RED-991). Docs: checkly/docs#520, to merge with the CLI release.

🤖 Generated with Claude Code