Avoid decoding external activity payloads in metadata projections

[rmcdaniel]

Reproduction

During qualification of durable-workflow/server#141, a 64 MiB external Avro activity result is validated and retained without an inline copy, but activity completion still exhausts the published Server image PHP 128 MiB limit. ActivityOutcomeRecorder::projectRun() invokes RunSummaryProjector, which calls RunActivityView::activitiesForRun() and decodes the complete activity result through publicTypedValue(). The summary needs lifecycle metadata, not the decoded application value.

The same eager helper is used by Server standalone activity inspection to obtain attempt metadata. Catching Throwable does not recover a PHP memory-limit fatal.

Required outcome

• Provide a metadata-only activity view mode that does not download or decode arguments/results while preserving typed-history authority and attempt/retry state.
• Use it for summary projection and other verified metadata-only consumers. Keep existing decoded-view behavior as the default for callers that explicitly need values.
• Preserve workflow/activity completion, history, task leasing, and external references across a fresh process/database reload.
• Add a regression whose external storage driver rejects reads, proving metadata projection never touches stored payload bytes.
• Qualify the package with the Server real-HTTP reproducer before publishing the combined fix.

Accepted dependency of durable-workflow/server#141; implementation stays in this owning package, with Server integration in durable-workflow/server#142. No production runtime or memory allocation has been changed.

[rmcdaniel]

The implementation is merged in #491 and full source CI passed. The merge auto-closed this issue; keeping it open only until the patch is installable and verified. Publication is in release PR #492, not awaiting human review. Server integration has already passed the exact-limit HTTP and cold-recovery checks with the candidate source.

[rmcdaniel]

Released and verified in Workflow 2.0.7: https://github.com/durable-workflow/workflow/releases/tag/2.0.7. Packagist resolves immutable d61ca42. The published-package/platform check and all 16 Laravel/PHP upgrade cells passed: https://github.com/durable-workflow/workflow/actions/runs/34206995339.

Full implementation CI passed before merge, and the published src/ tree exactly matches the qualified candidate. Server #142 now pins 2.0.7 and passes 117 focused tests / 840 assertions without a source overlay. The engine issue is complete; the separate Server release remains in progress.