Checked persistence boundary for memory-outbox payloads.

Events are converted to the canonical event codec, sensitive fields and common credential-shaped text are redacted, and only bounded JSON-safe maps are returned. Stable job and batch IDs are derived from event IDs rather than runtime Erlang terms.