Filter protected Dokploy proof logs by event

[cbusillo]

Summary

• use the code-owned allow-listed event name as Dokploy's provider-side fixed-string filter
• preserve a separate unfiltered bounded read for independent provider-error classification
• keep exact parsed JSON event matching and fail-closed proof eligibility unchanged
• cover empty search, allow-listed search, and hidden-provider-error regression behavior

Why

The exact deployed worker remains running while the general runtime log read returns one unrelated non-JSON candidate. Filtering the bounded read to the requested lifecycle event can recover the canonical event without weakening proof, while the independent unfiltered read ensures provider errors cannot be hidden by search.

Validation

• focused runtime evidence, target inspection, and HTTP tests (29 tests)
• uv run --extra dev launchplane ci unittest-shard local (3,080 targets; 12/12 shards)
• uv run --extra dev mypy control_plane tests (759 files)
• changed-file Ruff and format checks
• production image build
• independent exact-diff review approved

Refs #2219