Reject internal-only events received through protocol gossip #1665

Audit reference: I21

What can go wrong

An authenticated peer could send internal infrastructure events through gossip or historical sync even though those events should be created only inside the receiving node.

When it happens

The boundary is crossed whenever remote gossip or a history page is decoded into an InterfoldEvent.

What changed

Both network paths now use one explicit allowlist of protocol events that are safe to forward.

Why the change works

Authentication proves who sent a message, not that every internal event type is legal; the allowlist enforces that second rule consistently.

Checks

Internal-event rejection, allowed-event, and cross-aggregate history tests pass.