fix(api): release-audit follow-ups for the agent API work - #9910

The id in error bodies is the request id that x-request-id carries and logs
store as requestId; traceId already means the OTel trace id in logs, so a
search by the published value found nothing.

Only null values are dropped, every sub-block hidden from agents is dropped
(some are real configuration), and blocks whose parent container is gone are
left out, so point readers at Get workflow state for the full configuration.

Adds an integration suite for listWorkspaceLiveSchedulesPage: it returns the
rows the per-workflow live list reports, leaves out archived, undeployed and
other-workspace workflows, and pages through createdAt ties without repeats or
gaps. sortBy=createdAt now says that each deploy creates new schedule rows.

sim login --expires-in without --method failed on servers that offer OAuth,
because OAuth was chosen and then refused the flag; a lifetime now selects the
API-key handoff. A refused handoff key no longer says nothing was stored: it
already exists on the account, so the CLI points at how to revoke it.

RE2-based validators (Go, Rust, many gateways) reject lookaheads, so the
OpenAPI pattern for logoUrl could not be compiled there. The rewrite accepts
and refuses exactly the same values.

The poll contract strips unknown keys and the route never reads them, so
sending access and expiresInDays in the body proved nothing. The test keeps
checking that the approval's access and lifetime reach the mint.

applyWorkflowOperations now hands the persistence primitive a reader, which
skipped its pre-lock withheld-block check, so a refused batch took the row lock
and re-read the graph first. The use case checks the graph it composed before
writing. A failed re-read under the lock is now an internal error instead of a
400 saying the workflow has no state.

…ostgres

Holds the workflow row lock to force each interleaving: an unchanged workflow
with containers and a migrated legacy block commits, a write that lands after
the base read is refused as a conflict, and of two concurrent applies one
commits and the other is refused with nothing lost.

The applies and the lock-wait poll started inside the lock holder's
transaction callback, so the transaction tripwire refused them. They now leave
that context, the applies run in a permission-group scope as routes do, and an
apply that settles early is reported without awaiting the ones queued on the
held lock.

--expires-in without --method chose the handoff before the reachability
probe, so a mistyped endpoint printed a pairing code and polled instead of
failing fast. The probe now runs first. A refused key from a server that does
not report its name is described by the name pattern and time it was made.