sync wire fix (bare array + string delivery_id), WS delivery acks, dedup, terminal closes — 1.0.21

[sanctrl]

What

Fixes the broken /v1/messages/sync wire contract — production returns a bare JSON array with opaque string delivery_id cursors, but the SDK typed {envelopes: [{delivery_id: number}]}, making the realtime client's post-reconnect offline drain a silent zero-row no-op (TypeError swallowed by a void fire-and-forget). This has been broken in every published version; the hand-rolled workaround in agentchat-coding-agents/core/src/lib/wire.ts is the reference this now matches.

Also ships the client half of the WS delivery-ack protocol (server repo docs/realtime-delivery-ack.md), closing the delivered-on-socket-write at-most-once gap once the server side deploys.

Changes

• sync() → SyncEnvelope[] (breaking type change — runtime was already broken; migration notes in CHANGELOG); syncAck(string) → {acked}
• Drain rebuilt: cursor pagination, positional ack of the settled prefix only, clean-prefix stop on invalid rows, handler-throw ⇒ no ack, gap-buffer rows never acked before dispatch, errors surface via onError
• Capability-negotiated WS acks: HELLO advertises ['ack']; fully dormant against today's server (no capability echo ⇒ zero new frames)
• Bounded message-id dedup LRU (default 2048) across live+drain — duplicates are by design under at-least-once, loss is not
• Close codes 1008/4401/4403 terminal: no more infinite reconnect on revoked keys
• Paginator audit vs live routes: contacts/agents keys match — no drift
• New wire-contract test suite pins the real shape so CI can't be green on the wrong wire again

Verification

• 107 tests passing (was 86), tsc --noEmit clean, tsup build clean (ESM+CJS+DTS), version 1.0.21 build-injection confirmed

Release

Not published — tag + OIDC pipeline per RELEASING.md when ready.