fix(runtime): keep operation identifiers redaction-stable

[drewstone]

Fixes the release-blocking plain-mode crash caused when a timestamp suffix resembled a credential and redaction changed the operation identity.

• Generate plain-mode operation IDs from UUIDs only.
• Reject any domain identifier that durable redaction would change.
• Validate every public run mutation before provider work or journal writes.
• Add deterministic regression coverage for the original collision and bypass paths.

Verified locally:

• pnpm run test:unit: 230/230 passed
• pnpm run test:rpc: 35/35 passed
• pnpm run typecheck
• pnpm run boundaries: 466 modules, 0 cycles
• pnpm run build

No visible UI changed.