fix: mark system Nexus envelope payloads

[tconley1428]

What changed

• Mark system Nexus envelopes when they are created.
• Detect marked envelopes anywhere workflow codecs visit a payload, so nested user payloads are encoded and decoded after an envelope is stored in a generic payload field.
• Keep unmarked payloads on the regular codec path and preserve batch codec behavior for ordinary payload collections.