Agent surface lane: whiteboard authority rework + collapse

[omridevk]

Parent

#579

What to build

The whiteboard router stops being a trusted-client API and becomes the single safe surface for widget and agent: authority (room, author, ids, timestamps) derived server-side from ambient session and caller principal, never accepted from input; comment/pin orchestration (anchor enrichment, atomic comment+pin, thread rules) moves from the facade tools into the procedures and the raw table CRUD for those domains ceases to exist; server-generated ids require an optimistic-sync reconciliation protocol (client correlation key echoed in mutation responses) designed BEFORE deleting raw CRUD so widget optimistic rows re-key instead of duplicating.

Spec: docs/superpowers/specs/2026-08-22-agent-api-surface-design.md (facade collapse — whiteboard; mandatory verb-by-verb migration table covering comments, pins, reads, cursor, canvasPending, canvasReplies, elements incl. bulk ops: server-generated vs ambient fields, owning identity, cross-room rejection, bulk transaction semantics, agent visibility per verb).

Acceptance criteria

• Full verb-by-verb migration table reviewed before implementation
• No authority-bearing input fields remain; cross-room operations rejected; ownership validated on patches
• Agent-created content is agent-stamped, widget-created user-stamped, by construction
• Optimistic-sync re-key protocol implemented; widget flows unchanged (CI whiteboard suite green)
• Comment/pin facade tools deleted; canvas tools without router equivalents remain as procedures

Blocked by

• Agent surface lane: gate core #583 (gate core)