Explicit macOS surface is lost from recorded actions and replay scripts #3216

Problem

An explicit macOS surface is lost at the canonical action-recording boundary. On agent-device 0.21.12, open <owned-app-bundle-id> --platform macos --surface app succeeds, but its action.recorded entry contains details.flags: { "platform": "macos" }, with no surface. Consumers cannot distinguish an explicitly app-scoped open from desktop/frontmost-app opens safely.

The same declaration remains in upstream main 2212eacf5be976acc78378a7e65539be5fc81489 and the public npm 0.21.20 tarball: surface has recorded: false, so recordActionEntry removes it before the journal's existing open-surface allowlist. The .ad open serializer/parser also omit it, so recording and replaying a desktop or menubar session changes its target surface.

Required behavior

Preserve a supplied --surface app|frontmost-app|desktop|menubar in canonical actions, projected open events, and .ad open round trips. Keep an omitted surface omitted; do not infer the session's effective surface or broaden free-form event fields.

Completion

An actual SessionStore record/event test preserves each explicit enum value and distinguishes omission. Saved open scripts round-trip the explicit value without turning --surface into an app positional, and malformed surface input is refused. Existing privacy filtering remains intact.