Runtime ladder: add the telemetry_dropped reason and drop internal references

[maximelb]

Two changes to the runtime-package ladder added in #392.

1. The telemetry_dropped reason

The backend added a verdict reason after #392 shipped: telemetry_dropped means the agent discarded some of its own buffered telemetry during the window (a load spike on the host), so the process and module events that would have shown the code running may never have arrived. It is a fact about the monitored host, and deliberately distinct from write_shed, which is the platform shedding work — the two have different remediations.

No behaviour change. RUNTIME_REASONS is a reference list, not a validator: an unrecognized reason is already returned verbatim and never dropped, so the SDK did not break when the token appeared. The gap was in what it could explain, and the guard test that pins the exact list is what turns that gap into a build failure. Its docstring now records that the list has drifted twice.

2. Internal references removed

This is a public repository. The runtime-ladder code, tests and user documentation from #392 cited internal repositories, pull requests, issue trackers and planning documents that readers cannot open. Those references are removed and the rules they cited are restated in plain terms — for example, "decode legacy dormant as not_observed but never emit it" and "a runtime negative is only reported on a complete window".

doc/code-security/runtime-evidence.md in particular ended with a block of links to internal pages; that block is gone.

Wire shape

Unchanged. No envelope field, row field or status token is added, removed or renamed.

Tests

tests/unit/test_sdk_runtime_package_ladder.py and tests/unit/test_cli_cloudsec.py: 262 passed locally.

🤖 Generated with Claude Code

[maximelb]

Self-review (this repository does not use an automated reviewer)

Reviewed the single commit on the branch head from a clean checkout.

• Behaviour: none changes. RUNTIME_REASONS is read only by the guard test and as documentation; nothing rejects or rewrites a reason absent from it, and check_finding_runtime returns the gateway response verbatim.
• The new token matches the backend's reason vocabulary exactly. A mechanical comparison of this branch's list against the backend's is now identical (18 tokens each); master lacked exactly telemetry_dropped.
• Availability reasons (cache_unavailable, feature_disabled, no_packages, no_resource, no_sensors) are unchanged, match the backend exactly, and stay disjoint from the verdict reasons.
• Reference removal: checked that no remaining line in the three touched files names an internal repository, pull request, issue tracker or planning document, and that every rule previously cited by reference is still stated in plain terms, so no guidance was lost.
• Tests: 262 passed locally across the ladder and CLI suites.

Not in scope and not changed here: two older mentions in limacharlie/commands/cloudsec.py and tests/unit/test_cli_cloudsec.py, a program line in doc/cli/cloud-security.md, and CLI examples that use an internal fixture repository name. They predate this work and are flagged separately.