fix(factory): isolate runtime projection failures

[walker-tx]

Summary

• keep strict runtime-event projection fail-closed
• prevent diagnostics projection failure from replacing a valid Kit/report outcome
• omit diagnostics after rejected projection while preserving ordinary stderr and suppressing marked records

Root cause

Box run 33207230591 reached Run Kit, then the projector rejected its marked stream. The entrypoint unconditionally exited 1 before evaluating the real Kit/report result, so observability could fail the factory.

Testing

• bash factory/tests/test-container.sh
• GOFLAGS='-ldflags=-linkmode=external' bash factory/tests/run.sh (13/13)
• mise x shellcheck@0.10.0 -- shellcheck factory/scripts/.sh factory/tests/.sh
• mise x actionlint@1.7.7 shellcheck@0.10.0 -- actionlint .github/workflows/guide-draft.yml
• git diff --check

Security

Malformed, unknown, and over-cap marked streams are still drained, suppressed, and removed with only the fixed safe error. No rejected diagnostics artifact is built or uploaded.