docs(resource-value-verification): close design-review doc/comment gaps

Two retrospective design-review findings:

- design.md's System Flows sequence diagram showed the controller-layer
  resval check as an independently-launched client session, implying no
  dependency on the injecting worker staying connected. As-built (bug-1579),
  host-attrs resources reset to baseline the instant the worker disconnects,
  so the check actually runs nested inside the still-open worker session via
  xce_test's `!` shell-escape. Updated the diagram and prose to show this,
  and documented the still-open residual risk for custom host-attrs
  resource names in Error Handling.
- Added explicit "do not change this format" warning comments at both
  trace-log call sites (core_events.c's RESVALS_DELTA case, apiserver's
  OnResourceLocationUpdated) that xce-test-resources' log-grep depends on --
  an unrelated logging cleanup at either site would otherwise silently turn
  every future verification run into a false UNREACHABLE/timeout.

No behavior change in either source file -- comments only.

src/frontend/apiserver/backend/handler.go

@@ -99,6 +99,16 @@ func (h *DefaultHandler) OnResourceLocationUpdated(res *models.ResourceDistribut
 	// field carrying whichever of StringValue/NumericValue/BooleanValue is
 	// live for res.ValueType, so a downstream grep sees exactly what was
 	// stored, not every possibly-zero field on the struct.
+	//
+	// DO NOT change the "resource-location stored" message string, or the
+	// resource/host/value field names below, without also updating
+	// query_apiserver_resvals() in
+	// .claude/skills/xce-test-resources/run-resource-verify.sh (design.md's
+	// own Revalidation Triggers list this exact pair) -- that script greps
+	// this exact message and parses zap's console-encoder trailing JSON
+	// block for these field names; an unrelated logging cleanup here
+	// silently turns every future verification run into a false
+	// UNREACHABLE/timeout, indistinguishable from a real regression.
 	var valueField zap.Field
 	switch res.ValueType {
 	case int(models.STRING):