Tighten opaque plugin content boundaries

platform_web/schemas/runtimeUpdates.ts

@@ -24,12 +24,7 @@ const forbiddenProjectionKeys = new Set([
   "stagingpath",
   "backuppath",
   "socket",
-  "credential",
-  "pid",
-  "content",
-  "payload",
-  "bindings",
-  "downloadref"
+  "credential"
 ]);
 export function parseSafeDependencyCatalog(value: unknown): DependencyCatalogResponse {
   const record = requiredRecordValue(value, "dependency catalog");
@@ -131,14 +126,9 @@ function parseRunUpdate(record: Record<string, unknown>): RunUpdateJobResponse {
 }
 
 function rejectForbiddenProjection(value: unknown): void {
-  if (Array.isArray(value)) {
-    value.forEach(rejectForbiddenProjection);
-    return;
-  }
   if (!isRecord(value)) return;
-  for (const [key, field] of Object.entries(value)) {
+  for (const key of Object.keys(value)) {
     if (forbiddenProjectionKeys.has(key.toLowerCase())) throw new Error(`runtime projection contains forbidden field ${key}`);
-    rejectForbiddenProjection(field);
   }
 }