feat: add stable Forward and Managed API operations

[moonyue-w]

Summary

SDK callers currently lack typed methods for Forward credential rotation and hourly Usage aggregation, Managed Session cancellation, and deployment-scoped Run queries. Add these six operations with matching resource exports, models, contract fixtures, and live scenarios across the Go, Python, and TypeScript SDKs.

• Forward credential updates merge auth/metadata, preserve omitted fields, support null metadata patches, and disable automatic retries for write-only secret rotation.
• Forward Usage aggregates Identity and Template activity with hourly start_at / end_at bounds in Asia/Shanghai, fractional active_seconds, multi-ID filters, and pagination. Only the new parameter contract is exposed.
• Managed Session cancellation parses the lightweight acknowledgement returned for HTTP 200 (idle) and 202 (active).
• Deployment-scoped Run listing/retrieval preserves deployment ownership, filters, workspace headers, and opaque pagination cursors; the global Run resource stays available.

Why

Expose the documented stable API operations through the public SDKs so callers can use typed resource methods instead of issuing their own HTTP requests. Keep the three language implementations consistent.

Verification

• make lint
• make build
• make test
• make docs-check
• go build ./examples/...
• Account-backed integration tests run

Offline unit/contract tests and live-tag cleanup tests passed. Live-tag compilation also passed. Changelog validation and all 19 release automation tests passed.

Targeted account-backed scenarios for the retained APIs passed on CN and Global during this task: Usage, credential merge patches/redaction, idle/active Session cancellation, and deployment-scoped Run queries. Those runs used the task working trees before final scope cleanup; the final committed trees received the offline checks above. Empty Usage pages verify the collection envelope; fixtures cover item types and cursor/filter replay. Cancellation tests record HTTP 200/202 because completion may race cancellation.

Impact

• Public API or behavior changed
• User-facing changes recorded in CHANGELOG.md under Unreleased
• Generated API documentation updated
• Forward/Managed contract fixtures updated
• Python and TypeScript parity considered
• No credentials, .env.live, logs, or generated test output committed

No migration is required for existing Go callers.