fix: restore conversation permission contract version validation after #614 #639

Deferred from PR #614

The repository owner explicitly approved merging PR #614 first and addressing this P2 immediately afterward in a separate fix PR.

Review: #614 (comment)
Verified PR head: 7708f81d6667c2b4965664700332b1d2c7185e0f (20/20 checks successful).

The conversation stream parser no longer calls assertPermissionContractVersion. Unsupported schemaVersion values and schema v2 requests containing legacy permission fields can therefore miss the documented HTTP 400 contract validation. The web conversation API also needs to preserve the canonical v2 marker when normalizing permission requests.

Acceptance

• Restore the shared permission contract guard at the conversation stream request boundary.
• Reject unsupported schema versions and v2 requests with legacy permission fields using the existing typed HTTP 400 errors.
• Preserve valid v2 requests and the intended unversioned/v1 compatibility behavior.
• Ensure the web request normalizer preserves or supplies schema v2 consistently with the existing shared permission contract.
• Add regression coverage that fails against the merged baseline and passes with the fix.

Closing the original review discussion records this explicitly accepted deferral; it does not mean the defect was fixed in #614.