b045d0c5e9
The write_envelope tool was silently accepting YAML without a 'facts:' top-level key. serde would ignore unknown fields and default the facts HashMap to empty, causing the predicate pipeline to always see no facts. Now validates that envelope.facts is non-empty after deserialization, returning a clear error with an example of the correct format. Adds 6 tests covering valid/invalid/boundary deserialization cases.