fix(apiproxy): address session-export review — surrogate-safe chunks, backpressure drain, strict flag

Chunk boundaries never split a surrogate pair (a lone high surrogate
re-encodes as U+FFFD and silently corrupts the exported artifact), production
yields whenever the response queue fills so a slow consumer bounds the
accumulation, includeDescendants rejects values other than true/false instead
of silently under-exporting, the dead missing-services arm is deleted by
narrowing the streaming deps, and the readRaw failure answers 500 without
leaking host paths into the browser error bar.

packages/host/apiproxy/src/api/downloads.schema.ts

@@ -10,11 +10,15 @@ import { z } from 'zod'
 import type { DownloadsApi } from './downloads.ts'
 import { sessionIdSchema } from './sessions.schema.ts'
 
-/** session.export query params → the sessionLog request. */
+/**
+ * session.export query params → the sessionLog request. `includeDescendants`
+ * accepts exactly `true`/`false`/absent; any other value is rejected (400) so
+ * a misspelled flag cannot silently under-export.
+ */
 export const sessionLogQuerySchema = z
   .object({
     sessionId: sessionIdSchema,
-    includeDescendants: z.string().optional(),
+    includeDescendants: z.union([z.literal('true'), z.literal('false')]).optional(),
   })
   .transform(query => ({
     sessionId: query.sessionId,