Record exclusive-allocation deploys in run-key history

[TheGreatAxios]

Summary

Exclusive-allocation deploys rotate workflow_run.public_key through updateAnchorPublicKeyUnderAllocationLock, then emit agent.deploy.ack with allocated set. @corbits/run-key-history skipped those acks, matching the orchestrator listener's guard — but that guard is not how the service path writes the key. Result: zero history rows for that entire deployment class, so signature re-verification failed for it.

This drops the allocated skip in our listener so every observed deploy ack is recorded, including exclusive-allocation deploys and post-failure allocation replacements. No dual path, no vendor edits.

Shared-capacity writes (deployCodeSourcedWorkflow, deployAdoptedCodeSourcedWorkflow) already emit ordinary acks and were already recorded.

Test plan

• Converted the PR CL-7274: document run-key-history's exclusive-allocation gap #523 test.failing to a passing test; inverted the skip-contract test
• HUB_DATA_DIR=$(mktemp -d) bun test packages/run-key-history — 26 pass, 0 fail
• bunx tsc --noEmit -p packages/run-key-history/tsconfig.json
• prettier --check / eslint on the changed files
• check:report-error is already red on main and unrelated

Closes the live gap tracked in CL-7274.