Sigh. Okay, so after digging into the TIBCO code itself a bit more I found something called an "Envelope". TibrvMsg.setEnvelope() and TibrvMsg.getEnvelope(), and it's value is another TibrvMsg object. Assuming this is what they're talkign about, it's not a mapped message field. It's a completely separate, apparently optional part of TibrvMsg.
The short answer is we don't support this. The feature is so obscure and weird that the first relevant hit on Google is the CA Communities forum thread you are reading right now.
The long answer is that they can use a Script step to construct a TibrvMsg object however they want, save it into a testExec property, select "Object" for Publisher Info -> Message, and finally enter the testExec property name in the Send Message Data tab. This means the *entire* message, the "outer" TibrvMsg along with the "envelope" TibrvMsg, must be constructed by hand in the script step, but it's at least possible.