Project deployment rules and error codes from Go

[SaladDay]

Summary

AGENTS.md says each rule has one authored definition, and other languages either generate it or check it against shared fixtures. The repository already does this in two ways: cmd/specification-contract, which projects Go to Python, and the node-diagnostics fixture. This change extends those two mechanisms to rules that TypeScript copied by hand. Two of those copies had drifted. This is T2a in the architecture audit.

• Deployment contract.
  • specification-contract -write now also generates packages/agents-client/src/deployment-contract.ts: the resource bounds, the Runtime release patterns and the minimum disk size. The existing freshness test covers both outputs.
  • The hand copies in Web are deleted (runtime-release.ts, the inline bounds and patterns, and the numbers in the wizard help text).
  • Drift fixed: Web now requires oac-runtime@sha256:<64 hex> for microsandbox_ref, as Core does. It used to accept any image name.
• Core error codes.
  • The single list is services/core/internal/api/testdata/core-errors.json (43 codes).
  • TestCoreErrorCatalog checks both directions. Every listed code must have a Go producer. Every literal code passed to the /core/v1 error writers must be listed, documented in wire-semantics.md, or excluded with a reason.
  • The core-errors.md tables (en and zh) and both Web locale message sets must equal the list exactly.
  • Ten codes that Core already produced but never documented or localized are added. sandbox_admin_not_configured, which had no producer, is deleted.
• Model-provider protocol names.
  • modelprovider.Protocols() is the source, and the Harness catalog generator projects it into harness-catalog.ts.
  • Five TS copies now import it.
  • Drift fixed: core-error.ts was missing chat_completions.

Behaviour

• Web localizes the 10 newly catalogued codes.
• Web rejects a non-oac-runtime microsandbox_ref.
• An allowed_protocols detail that includes chat_completions now gets the localized message.

Checks

• specification-contract -write and make check-harness-catalog (no diff).
• go build ./... and go vet ./....
• Go tests for specification-contract, sandbox, api, modelprovider, harnessconfig and harness-catalog.
• tsc for agents-client and Web, plus vitest (739 client tests, 384 Web tests).
• Website translation test and check-names.py.

Net: code +54 lines (the generator wiring and 20 new locale messages); tests and fixture +192.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}