test(sdk): add public API contract coverage

[marmar9615-cloud]

Summary

Adds SDK public API contract coverage and a lightweight SDK example to support post-v0.4.0 SDK/API stabilization work on the road to v1.0.

PR #26 (test(openapi): add converter regression fixtures) was merged first at 09c3212f0d44199d756cf98eada5b075dcccf841. PR #28 has now been rebased onto latest main after PR #29 and the v0.4.0 publish/status update.

Release coordination

• v0.4.0 is published and released: GitHub release v0.4.0 exists, and all six @marmarlabs/agentbridge-* packages are live on npm at 0.4.0.
• v0.4.0 release-prep content was preserved during the rebase.
• This PR's changelog entry is intentionally under Unreleased, making it post-v0.4.0 SDK/API stabilization work.
• No package versions changed.
• No release files were touched except CHANGELOG.md conflict resolution.

Claude / parallel work context

Claude may be working near HTTP transport/auth release follow-up areas. This PR stays parallel-safe by avoiding MCP runtime and HTTP transport files entirely.

Files added

• examples/sdk-basic/README.md
• examples/sdk-basic/manifest.ts
• packages/sdk/src/tests/public-api-contract.test.ts

Files modified

• CHANGELOG.md
• examples/README.md
• packages/sdk/README.md

SDK public API behaviors pinned

• Public exports: defineAgentAction, createAgentBridgeManifest, createActionHandler, validateActionInput, and z.
• defineAgentAction preserves manifest-facing metadata, schemas, permissions, examples, confirmation policy, risk, and humanReadableSummaryTemplate.
• createAgentBridgeManifest produces a core-valid manifest and preserves supported metadata, resources, contact, and auth fields.
• validateActionInput accepts valid input, rejects missing required fields and wrong types, and preserves the existing raw JSON Schema object fallback.
• createActionHandler validates input before calling handlers, returns structured JSON success responses, handles malformed/invalid input with 400s, parses GET query parameters, and reports handler failures with 500s.
• examples/sdk-basic builds a safe simulated support-ticket action set and validates it with the core manifest validator.

Validation after rebase

• gh release view v0.4.0 confirmed the GitHub release is published.
• npm view @marmarlabs/agentbridge-core@0.4.0 version returned 0.4.0.
• npm view @marmarlabs/agentbridge-sdk@0.4.0 version returned 0.4.0.
• npm view @marmarlabs/agentbridge-scanner@0.4.0 version returned 0.4.0.
• npm view @marmarlabs/agentbridge-openapi@0.4.0 version returned 0.4.0.
• npm view @marmarlabs/agentbridge-cli@0.4.0 version returned 0.4.0.
• npm view @marmarlabs/agentbridge-mcp-server@0.4.0 version returned 0.4.0.
• npx vitest run packages/sdk/src/tests/public-api-contract.test.ts passed: 1 file / 11 tests.
• npm run typecheck:clean passed.
• npm test passed: 16 files / 196 tests.
• npm run build passed.
• npm run pack:dry-run passed.
• npx tsx examples/sdk-basic/manifest.ts > /tmp/sdk-basic.agentbridge.json && node packages/cli/dist/bin.js validate /tmp/sdk-basic.agentbridge.json passed.
• npm run smoke:http passed: 13 ok, 0 fail.

Safety / release confirmations

• No MCP runtime behavior changed.
• No MCP HTTP files were touched.
• No package versions changed.
• No package-lock.json changes.
• No npm publish, git tag, or GitHub release happened from this PR.
• Dependabot was untouched.
• No runtime fixes were needed.