Behavior-preserving; 231 BattleNode tests green.
The envelope key set was encoded three times (ReservedEnvelopeKeys, the ToJson
writes, the FromJson reads). Added a private nested MsgEnvelope.Keys with a const
per key; the reserved set, writes, and reads now all draw from it, so a key added
in one place but not another (letting a body key shadow an envelope field) can no
longer happen.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>