fix(ui): handle unexpected timeline payloads

[giaBaoJS]

Please verify the following:

• yarn build-and-test:local passes
• I have added tests for any new features, if relevant
• README.md (or relevant documentation) has been updated with your changes (not applicable: no public API or setup changed)

Describe your PR

Fixes #1600.

Timeline commands can now be produced by the MCP server as well as the client SDK, so their runtime payloads are not always as complete as their TypeScript contracts. This keeps each affected command visible in the timeline instead of dropping into the generic RENDER ERROR entry when optional data is missing or has the wrong container shape.

Command	Guard	Safe fallback
Async Storage mutation	Check that data is an object with a key	Keep the action-only preview
API response	Normalize missing request/response objects and validate preview strings	Render the available summary and tabs
State values change	Count only non-array objects	Ignore scalar/array change groups
Benchmark report	Validate steps before reading the final entry	Show the benchmark title with no step rows
Saga task complete	Validate children before reading/mapping it	Render 0 Effects

Valid payload rendering remains unchanged. The API toolbar receives the normalized request and response too, so its callbacks do not reintroduce the same unsafe nested access after the row opens.

Test plan

• Added 15 component-level tests through the real timeline command wrappers and error boundary: 10 malformed-payload regressions plus 5 valid-payload controls.
• Counterfactual with the final tests kept and all five source guards reverted: 10 failed, 5 passed. Restoring the guards: 15 passed.
• Reverted each source hunk independently; only that component's malformed-payload cases failed while its valid control stayed green.
• reactotron-core-ui: 10 suites, 99 tests passed.
• yarn build-and-test:local: passed build, package validation, lint, format, all workspace tests, and typecheck for all 13 projects.
• Rendered malformed and valid records through the built CommonJS timelineCommandResolver; every record kept its command title, none rendered RENDER ERROR, and the valid previews remained intact.