Resolve runtime external payload references before task and result decoding

[rmcdaniel]

Confirmed failure

Published Rust SDK 2.0.2 cannot resume a workflow when Server externalizes its activity result. With Server 2.3.0 and namespace local external-payload storage enabled at 64 KiB, a 256 KiB string activity result is persisted successfully, but the resumed workflow task fails with:

codec error: invalid_payload_envelope: durable payloads must use an object with string codec="avro" and blob fields

The SDK has no runtime external_payload reference resolver. It sends the transport reference directly to the inline Avro validator. The same experiment succeeds for PHP 2.0.7 and Python 2.0.3. Each activity executed exactly once; Rust repeatedly failed workflow replay after activity completion. This is a product failure, not a storage-admission success claim.

Reproducer: durable-workflow/server#136, published Server digest sha256:b9cf45fc75dab4c505b2bebe83ac3aeb9fa34d8a18011681fc747314a7ed3452. It was discovered in an isolated disposable MySQL fixture, not a customer namespace.

Acceptance

• Resolve runtime external references in protocol-owned task arguments/history and client result/history/export fields before Avro decoding, without interpreting arbitrary application metadata as references.
• Fetch only from the configured authenticated runtime with the same namespace and credential role; reject malformed IDs, redirects, size/hash mismatches, and oversized responses.
• Bound total bytes and deduplicate repeated references within one response; keep cache scope bounded.
• Add a minimal codec/replay regression and HTTP coverage for worker and client paths, malformed references, integrity failure, missing payloads, and unchanged application projections.
• Publish the patch and rerun the published-SDK storage-recovery experiment, including cold process/database restart.

Related: durable-workflow/server#131.

Completed in #37 and published as 2.0.3. Registry/source verification passed, as did the fresh published-SDK pressure and restart experiment. Rust consumed its externally stored activity result and completed with the exact byte count/hash, one activity execution and no failed workflow tasks. Server/MySQL restart preserved all saved results and attempt identities. Focused regression coverage also proves cold workflow-context replay and bounded authenticated client/worker reference resolution.

[rmcdaniel]

The fix is merged in #37 and published as 2.0.3 through #38. Source CI, release archive verification and recovery of the original stalled Server run passed. The remaining acceptance item is the fresh published-SDK pressure/restart experiment in durable-workflow/server#136, now running with PHP 2.0.7, Python 2.0.3 and Rust 2.0.3 against Server 2.3.0.