Hosted campaign results: surface bounded validation rejection reasons

[jeffhuber]

Problem

During the v1.0.9 qualification campaign, Cursor Cloud Agent posted a trusted, correctly bound result marker whose adoption result used an unsupported host_class value. Code Mower correctly rejected it, but campaign status continued to say only that it was polling the provider until the one-hour deadline.

The closed validator and privacy behavior were correct. The operator diagnostic was not: a trusted response existed and was rejected, but the bounded reason was invisible.

Ask

• When a trusted, correctly bound hosted result marker is present but its adoption result fails closed validation, expose a bounded error code and safe field-level reason.
• Never persist or print the marker body, raw comment text, issue body text, source, diffs, prompts, transcripts, raw output, auth output, or secrets.
• Continue scanning later comments for a valid marker during the existing response window, so a provider can correct its result without an automatic paid redispatch.
• Make status, watch, Board, and JSON agree on the rejected-result state and next action.
• Add tests for invalid enum values, invalid identity, an invalid marker followed by a valid correction, and untrusted malformed markers.

Acceptance Criteria

• The operator sees that a trusted result was rejected and which closed field failed.
• No raw provider content crosses the metadata-only boundary.
• A later valid marker wins without duplicating dispatch.

Found in the v1.0.9 campaign under #729. The rejected result used host_class linux_x86_64 where the closed contract requires local, ci, github_actions, or unknown.