fix: guard privileged integration routes

[senamakel]

Summary\n- reject admin and webhook integration routes before transport dispatch\n- preserve the backend SDK route-policy contract for custom transports\n\n## Verification\n-

running 47 tests
test integrations::client::budget_gate::tests::budget_cache_get_returns_none_when_empty ... ok
test integrations::client::budget_gate::tests::budget_cache_returns_value_within_ttl_and_expires_after ... ok
test integrations::client::budget_gate::tests::cache_hit_skips_fetch ... ok
test integrations::client::budget_gate::tests::cache_miss_fetches_and_caches ... ok
test integrations::client::budget_gate::tests::failed_probe_is_not_cached_and_defers_to_backend ... ok
test integrations::client::budget_gate::tests::failure_backoff_is_keyed_per_backend ... ok
test integrations::client::budget_gate::tests::first_failure_reports_and_anchors ... ok
test integrations::client::budget_gate::tests::produced_sentinel_is_classified ... ok
test integrations::client::budget_gate::tests::repeat_within_window_suppressed_and_skips_backend ... ok
test integrations::client::budget_gate::tests::session_expiry_bypasses_backoff ... ok
test integrations::client::budget_gate::tests::success_clears_streak ... ok
test integrations::client::budget_gate::tests::usage_budget_exhausted_honors_remaining_and_bypass ... ok
test integrations::client::budget_gate::tests::usage_budget_exhausted_requires_real_cycle_signal ... ok
test integrations::client::budget_gate::tests::usage_failure_cache_freshness_window ... ok
test integrations::client::budget_gate::tests::window_expiry_reprobes_and_reports ... ok
test integrations::client::tests::error_propagation_tests::backend_egress_descriptor_strips_query_and_targets_backend ... ok
test integrations::client::tests::error_propagation_tests::enforce_backend_egress_blocks_user_data_but_allows_control_plane ... ok
test integrations::client::tests::error_propagation_tests::extract_error_detail_envelope_blank_error_falls_back ... ok
test integrations::client::tests::error_propagation_tests::extract_error_detail_envelope_missing_error_field_falls_back ... ok
test integrations::client::tests::error_propagation_tests::extract_error_detail_envelope_returns_inner_message ... ok
test integrations::client::tests::error_propagation_tests::extract_error_detail_envelope_trims_whitespace ... ok
test integrations::client::tests::error_propagation_tests::extract_error_detail_falls_back_for_non_json_body ... ok
test integrations::client::tests::error_propagation_tests::extract_error_detail_handles_empty_body ... ok
test integrations::client::tests::error_propagation_tests::extract_error_detail_truncates_long_non_json_bodies_at_char_boundary ... ok
test integrations::client::tests::error_propagation_tests::extract_error_detail_with_max_below_ellipsis_returns_empty ... ok
test integrations::client::tests::error_propagation_tests::get_403_propagates_backend_error_envelope_message ... ok
test integrations::client::tests::error_propagation_tests::integration_requests_carry_an_overridden_product_identity ... ok
test integrations::client::tests::error_propagation_tests::integration_requests_carry_the_default_product_identity ... ok
test integrations::client::tests::error_propagation_tests::jira_generic_400_classifies_as_backend_user_error ... ok
test integrations::client::tests::error_propagation_tests::jira_missing_subdomain_error_propagates_and_classifies_as_user_error ... ok
test integrations::client::tests::error_propagation_tests::local_only_rejects_user_data_verb_before_transport ... ok
test integrations::client::tests::error_propagation_tests::managed_budget_gate_applies_to_agent_integration_paths ... ok
test integrations::client::tests::error_propagation_tests::post_400_propagates_backend_error_envelope_message ... ok
test integrations::client::tests::error_propagation_tests::post_400_user_input_failure_classifies_as_backend_user_error ... ok
test integrations::client::tests::error_propagation_tests::post_500_propagates_html_body_truncated ... ok
test integrations::client::tests::error_propagation_tests::post_500_remains_actionable ... ok
test integrations::client::tests::error_propagation_tests::verb_methods_block_user_data_egress_under_local_only ... ok
test integrations::client::tests::error_propagation_tests::verb_methods_never_expose_admin_or_webhook_routes ... ok
test integrations::client::tests::session_expiry_tests::composio_soft_auth_path_covers_only_trigger_reads ... ok
test integrations::client::tests::session_expiry_tests::get_401_composio_triggers_keeps_sentinel_for_in_place_cta ... ok
test integrations::client::tests::session_expiry_tests::get_401_session_jwt_classifies_as_session_expired ... ok
test integrations::client::tests::session_expiry_tests::integration_client_new_strips_inference_path_from_backend_url ... ok
test integrations::client::tests::session_expiry_tests::non_401_4xx_does_not_classify_as_session_expired ... ok
test integrations::client::tests::session_expiry_tests::post_401_session_jwt_classifies_as_session_expired ... ok
test integrations::client::tests::session_expiry_tests::sanitize_backend_url_idempotent_on_clean_root ... ok
test integrations::client::tests::session_expiry_tests::sanitize_backend_url_preserves_empty_input ... ok
test integrations::client::tests::session_expiry_tests::sanitize_backend_url_strips_inference_path ... ok

test result: ok. 47 passed; 0 failed; 0 ignored; 0 measured; 10559 filtered out; finished in 0.03s

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[senamakel]

Superseded by #6367, rebased onto current upstream/main.