Generate the Core client types from the schema

[SaladDay]

The /core/v1 client types are now generated from contracts/agents-api/core.openapi.yaml, the same way #549 generates the /v1 types. Hand-written duplicates are deleted.

• Generation. make openapi makes scripts/openapi-split also write the Core document as JSON into its temporary directory. scripts/generate-public-api.py --core then projects the definitions that the Core paths reach into packages/agents-client/src/generated/core-api.ts.
  • Types the public schema owns are imported from public-api.ts.
  • A name that collides once the Go package is stripped keeps the package as a prefix.
  • Each inline enum becomes a named definition, so it gets a values list.
• Schema. Swag tags (binding:"required", extensions:"x-nullable", enums:) on the Core response types now declare presence, nullability and closed sets. They are inert at runtime.
• Client. admin-types.ts, sandbox-client.ts, core-metrics.ts, session-diagnostics.ts and the projections use the generated types and field lists. Hand-written shapes and validators are deleted.
• Web. The view-model copies in apps/web/src/lib/admin-view.ts are deleted. Pages read the client types and format RFC 3339 through epochSeconds. The wrappers and name checks that had no callers are removed.
• Docs. The client README and the coverage ledger (contracts/agents-api/index.md + zh).

What the schema now enforces that it did not before:

• runtime disk is required;
• a write operation's api_key is non-null, and resource_type and action are closed sets;
• SandboxNodeDiagnostic has no empty value;
• NodeUpdate.max_retained is optional.

Checks:

• go build, go vet and the focused Go tests pass;
• generate-public-api.test.py passes;
• make check-openapi shows no drift;
• client and Web unit tests pass;
• Playwright passes locally (two flaky page-load timeouts pass when rerun alone).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}