Align common Agents API wire responses with official behavior

[SaladDay]

Core returned different creation/event statuses and incomplete history list envelopes compared with owned-resource probes of the official service. Align successful creates to 201, event submission to 202, authorized empty events to a no-op, and Session/Turn/Item list envelopes to the observed shape. Align sampled error categories, retain null File/Skill error codes, and update the clients and generated schema.

Agent/Template empty updates now touch the existing resource timestamp without changing content or snapshots. Credential admission rejects empty secrets and OAuth patches without mutable fields before mutation. The fixed SDK 3.13.0 baseline and qualified native harness differences remain unchanged; newer Session updates and other outstanding semantics are documented separately.

Validation:

• Server make -o check-web check passed with dedicated PostgreSQL, fixed SDK tests, sqlc generation checks, native adapter packaging and Rust checks.
• Core Web/client type checks, production build, 287 client and 573 Web unit tests passed. Fixture Playwright: 73 passed initially; the remaining case passed after correcting its obsolete Beta error fixture.
• Full standalone official Python/Go client acceptance passed against real PostgreSQL, including restart, pagination, resource isolation and generated response schemas.
• Real deployed Core: 7 resource/safety groups and 9 successful model Turns across Codex, Claude Code and MiniMax Code. Rejected credential writes preserved encrypted rows and safe reads across restart. Network-interrupted attempts were retained separately; the successful rerun used verified model tunnels.
• Fresh GPT-6 Astra high independent full-diff review found no blockers; independent API/contract tests passed.

Real service/runtime source was 7c80d604; subsequent changes are test fixtures and nullable TypeScript error handling, without server/runtime changes. Rebased on main c96ea82 without patch changes; targeted API/execution and three real-PostgreSQL scheduling regressions passed against the combined tree. This is a bounded semantic alignment, not a claim of complete official compatibility. No new Provider, OAuth provider-refresh or capability matrix qualification is claimed.