Release pure-mock isolated run outputs past the provenance guard

An EMPTY server-synthesized run-from-block snapshot restores no values
at all, so there is nothing whose provenance could be untrusted — yet
the registry latched restored-provenance-untrusted on it, and the
egress projection withheld every pure-mock run_block result from the
model (found by the deep-eval lane: the agent ran its isolated unit
test, then fished the invisible output out of logs and gave up). The
carve-out is exact: only a snapshot with NO block states and NO
executed blocks skips the latch; any content-bearing snapshot keeps
the guard, and live secret resolutions register normally either way.

Claude-Session: https://claude.ai/code/session_01CgaxNAaeD3taGdghbXn17w

Author: Sg312

apps/sim/lib/workflows/executor/execution-core.ts

@@ -591,10 +591,18 @@ async function executeWorkflowCoreImpl(
     const restoredState =
       runFromBlock?.sourceSnapshot ?? (resumeFromSnapshot ? snapshot.state : undefined)
     const restoreTrusted = resumeFromSnapshot || Boolean(runFromBlock?.sourceExecutionId)
+    // An EMPTY snapshot (the server-synthesized base for a pure-mock isolated
+    // block run) restores no values at all, so there is nothing whose provenance
+    // could be untrusted — latching incomplete here withheld every isolated
+    // unit-test result from the model. Any snapshot WITH content keeps the guard.
+    const restoredStateEmpty =
+      restoredState !== undefined &&
+      Object.keys(restoredState.blockStates ?? {}).length === 0 &&
+      (restoredState.executedBlocks ?? []).length === 0
     const trustedLargeValueAccess = restoreTrusted
       ? restoredState?.trustedLargeValueAccess
       : undefined
-    const requireRestoredProvenance = restoredState !== undefined
+    const requireRestoredProvenance = restoredState !== undefined && !restoredStateEmpty
     resolvedSecretTraceRegistry = await createResolvedSecretTraceRegistry({
       personalEncrypted,
       workspaceEncrypted,
@@ -609,7 +617,7 @@ async function executeWorkflowCoreImpl(
       requireRestoredProvenance,
       scope: { userId: personalEnvUserId ?? workspaceEnvUserId, workspaceId: providedWorkspaceId },
     })
-    if (restoredState && !restoreTrusted) {
+    if (restoredState && !restoreTrusted && !restoredStateEmpty) {
       resolvedSecretTraceRegistry.markIncomplete('restored-provenance-untrusted')
     }
     if (options.trustedInitialResolvedSecretTraceProvenance !== undefined) {