#3530 Remote readResource does not apply the legacy schema fallback for untagged sensitive records

What happens

Locally, createResourceReader resolves vault references in a record with no sensitive-fields tag by falling back to the resource schema (src/domain/models/data_writer.ts, getSensitiveFieldsForResolution). The remote method context only reads the tag (src/worker/remote_method_context.ts), so an untagged legacy record comes back with the raw vault.get reference string instead of the value. A malformed tag is likewise treated as absent remotely, where typed-secrets section 9 says a malformed present tag must fail.

Evidence

Found by the swamp-club#3512 baseline: integration/remote_secrets_baseline_read_resource_test.ts (untagged legacy record and malformed tag cases).

Expected

Use the shared legacy schema fallback on remote as on local, from the verified bundle's model definition, per design/enablers/typed-secrets.md section 9.