#4391 workflow run: show artifact attributes for runs through serve, and let a run leave out the "Data produced" box

Problem

Follow-up to #4347. With that fix, local swamp workflow run and workflow resume show each artifact's attributes in the "Data produced" box, as behavior run does. Two gaps remain.

1. Runs through swamp serve still show a bare box. src/serve/deps.ts (createWorkflowRunDeps) doesn't supply the completed-run step-output reader. Serve runs on behalf of a principal, so the reader must apply the caller's data-read decision as a canRead policy (as createWorkflowHistoryGetDeps already accepts). Otherwise a remote caller could see attributes of records they may not read.
2. The box can't be left out. This is the first proposal in #4347. Some workflows return one fixed-name record that repeats on every run, and for them the box is noise. Ideas:
   • --quiet covering it, or a workflow run flag;
   • a resource-spec marker (for example display: false), so a behavior author can keep the data handle (for data list --workflow and report pointers) without it appearing in the run summary.

Proposed solution

1. Supply the step-output reader in serve's workflow run and resume paths, with the principal's canRead policy, so remote clients get the same box as local runs.
2. Decide on a way to leave the box out. A behavior-author marker keeps the decision with the person who knows the record isn't user-facing. A CLI flag is simpler but leaves it to each caller.

Alternatives considered

• Leaving serve as it is: remote and local runs keep printing different summaries.
• Hiding the box by returning no data handles: this breaks the link between the run and its data.