[SaladDay]

Official API alignment (ST-07/08/09, VT-01, VT-02/03, VT-04, EC-02 + SES-20).

The pinned-shape walker that already checks Agent bodies now also checks Session create and update, Vault create, Credential create and rotate, Environment Template create and update, and Session events. Field errors carry the JSON path as param with the official message forms (Unknown parameter: 'x'., Missing required parameter: 'x'., Invalid type for 'x': …, Invalid value: …), for example metadata, env.KEY, auth.type, auth.access_token, input[0].role and events[0].input[0].role. Core-local rules that the schema leaves open (HTTPS mcp_server_url, nonempty tokens, name limits, env names) keep Core's message but now name their field. Decoder branches and messages that became unreachable are deleted.

• scripts/generate-public-api.py projects the eight schemas (members with their own parser, such as Session agent/environment and Template network, are checked as objects only) and a string-or-array union; official_shapes.gen.go regenerated.
• Docs: wire-semantics.md, vaults.md, sessions-events.md (+ zh).

Checks: go test ./internal/api ./internal/environmentconfig ./internal/environmenttemplates, make check-openapi, integration tests for credentials, MCP credentials, request bodies, input and templates against a test database, go vet ./..., gofmt.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}