#3579 Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

Problem

A model method's execute may only return { dataHandles }. Anything else it returns (for example a result object from a read-only get, verify, or check method) is silently dropped: swamp model method run does not print it, --json does not include it, and it is not stored. Nothing warns the author that the value went nowhere.

This bites read-only methods in particular. A method like verify or status naturally wants to answer a question ("is the record present?", "does the remote match?") without writing a resource, but today the only way to make that answer visible is to write a resource, which creates a new data version on every call and adds noise to data history for what is really a query.

A related gap: sensitivity can only be declared on resource/data schemas (.meta({ sensitive: true })). If method results were surfaced, there would also need to be a way to mark individual result fields sensitive so they get redacted in human and --json output the same way resource fields are. (Separately, #3555 already covers --json echoing literal sensitive arguments; this request is about method outputs.)

Proposed solution

Either of these would help, roughly in order of preference:

1. Accept an optional result (JSON-serialisable) on the method return, validated against an optional resultSchema on the method definition. Show it in swamp model method run output and under a result key in --json; honour .meta({ sensitive: true }) on resultSchema fields for redaction. Optionally record it in the run record so runModel() callers and workflows can read it.
2. At minimum, warn (or fail extension quality / type checks) when execute returns keys other than dataHandles, and document in the model API reference that results must be written as a resource to be visible, with a short read-only-method example.

Alternatives

Writing a resource per call works today, but it turns every query into a versioned write. Logging the result via context.logger makes it visible but not machine-readable and bypasses sensitive-field redaction.