operations propose: a read operation's output is not returned, only the path to its .diff #24

What happens

cloudfall operations propose <id> runs a risk: read operation for real (the gate says runs-freely), but the envelope carries only the path to the decision's .diff file. cloudfall decisions show <id> returns the same record without the output. An agent that reaches Cloudfall only through the CLI tool or cloudfall mcp serve cannot read what the operation it just ran reported.

Reproduce

A read operation that prints something:

# operations/disk-report.yml
id: disk-report
description: Report filesystem usage
playbook: playbooks/disk-report.yml
risk: read
targets: host

$ cloudfall operations propose disk-report --target hz1
{"data":{"decision":{... "check":{"diff":{"path":"decisions/disk-report-20261008151935.diff", ...}}, "gate":{"requirement":"runs-freely"}, "status":"proposed" ...}}}
$ cloudfall decisions show disk-report-20261008151935
# same record, no output

The play output (df, du, failed units) exists only in decisions/disk-report-20261008151935.diff.

Expected

The envelope of a read operation returns its output in data, so the agent can act on it in the next step. The .diff file stays the record. decisions show could offer the same output for any decision, so a reviewer of a mutating proposal reads the check-mode diff without opening files.

Context

Found while an agent (Nemotron 3 Super on Nebius Token Factory) diagnosed a disk-full incident through a declared catalog on a disposable host. The read operations were the agent's only evidence; the harness had to read the .diff files for it.