Event Logs follow-up: EventData identifier correlation keys (EnrollmentId) #856

Part of #823.
Spec: docs/superpowers/specs/2026-10-08-event-logs-workbench-ui-handoff-design.md (see the section references below).
Design: Claude Design canvas "Event Log Viewer Redesign" (board exports to be attached).

Parent: #539 · Spec: §12, §15.2, Q-9

Add explicit correlation key kinds for EventData identifiers such as EnrollmentId to the unified-timeline
correlation engine (TimelineCorrelationKeyKind currently has activityId, relatedActivityId,
providerChannelEventRecord, processStart, sessionId, deviceId, userId, secondary).

Acceptance

• Exact edges only when the identifier is unique within one normalized machine (existing exact-match rules).
• cargo gates, wasm32 parser check, Windows-lab evidence on an enrollment failure corpus.

Generated by Claude Code