Report an unsaved trajectory somewhere that survives

A failed save must not fail the run -- the answer already exists --
but until now the only record of the loss was an error entry
appended to the trajectory that had just failed to save. §6 says
the trajectory is not optional telemetry; losing one silently is
the worst version of losing one.

The runtime has no logger by design, so ExecutionResult gains an
Unsaved list the surface reads and turns into a §10 log line with
run_id, tenant_id, agent_key and agent_version. Never serialised
to the client. Covered on all three run paths, streaming included.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJvibeSc1JYXjatankqM1g

go-api/internal/runtime/loop.go

@@ -605,8 +605,10 @@ func (m *ModelExecutor) finish(
 	// A sink that fails must not fail the run — the answer was already
 	// produced. It is recorded in the trajectory we could not save, which is
 	// the best available place for it.
+	var unsaved []string
 	if err := m.sink.Save(ctx, traj); err != nil {
 		rec.Error("runtime.trajectory_unsaved", err.Error())
+		unsaved = append(unsaved, traj.RunID+": "+err.Error())
 	}
 
 	// Delegated runs are written AFTER this one, because parent_run_id is a
@@ -617,10 +619,12 @@ func (m *ModelExecutor) finish(
 		if err := m.sink.Save(ctx, child); err != nil {
 			rec.Error("runtime.subrun_unsaved",
 				fmt.Sprintf("%s: %s", child.RunID, err.Error()))
+			unsaved = append(unsaved, child.RunID+": "+err.Error())
 		}
 	}
 
 	res := &ExecutionResult{
+		Unsaved:        unsaved,
 		Success:        term == TerminationCompleted,
 		Output:         output,
 		AgentID:        agent.ID,