[rmcdaniel]

Refs #127 and #128, durable-workflow/waterline#174.

Complete authorized terminal-output inspection on main using the existing bounded, authenticated runtime payload transport. The backend's explicit namespace authorization is required. Preserve the opaque reference, verify actual bytes/size/digest and retain typed Avro values. Foreign or unverified output is never fetched. Tests use the Server's declared opaque reference shape and cover false/null/zero, a real payload download through a prefixed runtime URL, operator headers and the configured byte limit.

Advance pending leased-authoring/shutdown work to the next prerelease train, 2.4.0-rc.1. Stable 2.3.0 is the separately qualified previous stable implementation plus operator catalog/result reads in #128. No prerelease tag is published here, and held breaking #111 remains unchanged.

The matching stable source passes 35 catalog/payload tests / 354 assertions and core PHPStan. Normal main source/framework/docs gates remain required.

[rmcdaniel]

Reviewed exact head f35e85041f15dcf29a0cb824babb981b59e170ef. Catalog detail decodes the actual committed result_envelope, preserves false/null/zero results and the raw opaque reference, and uses existing namespace/authentication/digest/size protections for external downloads. Foreign/unverified catalog detail does not hydrate any payload envelope. All 33 normal source, framework, package and documentation checks pass.

The matching stable read change is prepared separately in #130. Main's pending Nexus leased authoring and shutdown work remain on the explicitly prerelease 2.4.0-rc.1 train, and the held workflow lifetime PR is untouched. Main's portal build must not replace the stable published portal with prerelease documentation.