Validate sandbox node, allocation and deployment responses strictly in the client

[SaladDay]

Summary

Adds strict runtime validation for sandbox administration responses in packages/agents-client. This matches the admin client's other projections.

• Endpoints covered: listNodes, retrieveNode, listAllocations, and the deployment read and writes (retrieveDeployment, initializeDeployment, updateDeployment, setMaintenance).
• What fails: a response is rejected with 502 invalid_admin_response if it has an unknown member, is missing a required member, or has a member of the wrong type. Because unknown members are rejected, a reflected E2B key can't pass through. An invalid response to an E2B write becomes sandbox_configuration_unconfirmed.
• How the shapes were checked: they match Core's Go serialization. That was confirmed by marshalling the real structs.
  • diagnostic is omitted when a node is ready. An unknown diagnostic code is read as provider_unavailable, for forward compatibility.
  • enrollment_id and core_url are required.
  • A node detail must have its host and history.
  • An allocation diagnostic must be one of the database's constraint values.
  • A deployment's specification and specification_digest must appear together, and e2b must appear exactly when the provider is E2B.
• Contract note: contracts/agents-api/sandbox-deployment.md gets a short paragraph describing this validation.

Review and verification

• Gate: the full local server gate passed on 094c71f4 (Playwright browser cases skipped on the server; Chrome is unavailable there, and the skip is approved).
• agents-client: 630/630 tests pass.
• Frontend: the frontend merged this branch into a temporary worktree and ran its full e2e suite, 34/34. All 47 captured fixture responses pass the new projections. The e2e fixtures that sent shapes Core never sends were fixed first, in Make sandbox fixtures match what Core sends #155, and the preview mock data was fixed as well.
• Review: self-review plus the frontend's integration run. The change only makes the client stricter, and it was verified against real Go output.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}