Carry resource_ref through version metas and check a referenced runtime's keys

A commit dropped the mount's resource_ref: tree_inputs_from_state and
to_state (state_tree.py, stateTree.ts) copied resource_class and
resource_state but not the reference the registry built the resource
from, so cloning at a committed version handed Workspace.from_state a
mount with no way back to a class loaded from a script file (Python
asked for an override for `_mirage_user_backend`, TypeScript read the
ref as undefined). Both metas now carry it; a meta committed before the
key existed reads as null, the answer for a resource constructed in
code.

The TypeScript config loader constructed a `source:Class` runtime with
the entry's keys unchecked. The base constructor ignores a key it does
not read, so `captuers:` silently left the runtime on its defaults where
Python's `**options` refuses the entry. The ENTRY_KEYS check is now one
function, checkRuntimeOptions, run by buildRuntime for a name and by the
loader for a reference. Python needed no change; a test pins the
TypeError it already raises.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>