Refuse repaired or erased forge input bytes #495

🤖 Generated by the Agentic Engineer

Problem

The forge observers can replace malformed UTF-8 during JSON decoding or erase literal NUL bytes during shell capture, then classify the altered observation as healthy or fully resolved.

Proposed direction

Repair the owning observation or output boundary, with a regression that fails on current main before changing the implementation. Preserve the existing conservative behavior and public interface.

Acceptance criteria

• Validate original producer bytes before shell or JSON decoding can alter their identity.
• Refuse malformed or incomplete inputs with UNKNOWN and empty stdout, including partial producer failures.
• Keep valid Unicode and literal replacement characters valid; cover both CI-run classification and review-thread collection.

Size: S/M. Part of #223.