fix(admin): adagents.json builder always emits valid v3 authorization_type

[bokelley]

Summary

The /adagents/builder admin tool could produce authorized_agents[] entries with only url + authorized_for + delegation_type, which fails v3 schema validation. v3 requires authorization_type plus a non-empty matching selector on every entry.

Russell Stringham flagged this on the #4459 thread.

What changed in server/public/adagents-builder.html

• saveAgent maps the three access-mode radios to explicit v3 shapes:
  • Specific properties → authorization_type: property_ids (≥1 selection required)
  • By tag → authorization_type: property_tags (≥1 selection required)
  • All properties → snapshots every current property_id into property_ids (no implicit "all + future"; help text reflects this)
• updateJsonPreview drops the legacy fallthrough that emitted bare property_ids without authorization_type.
• editAgent reads v3 fields first; v2 property_ids/tag:-prefix shape is a legacy import path that auto-upgrades on next save. coversAll detection uses Set equality.
• renderAgents shows a red "⚠️ Scope not set" tag for stub agents (e.g. registry-picker imports) and a "(v2 — re-save to upgrade)" badge for legacy entries.
• copyJson / downloadJson now call blockIfAgentsMissScope to refuse export when any agent lacks authorization_type or when the contact section has fields filled but no name (v3 requires it).

Validated

• All three emit shapes (property_ids snapshot, property_tags, reference-mode) validate against static/schemas/source/adagents.json via Ajv with full core-schema graph loaded.
• Russell's bare {url, authorized_for, delegation_type} shape correctly fails v3 validation.
• 10/10 client-side logic tests pass (saveAgent paths, serializer, blockIfAgentsMissScope, contact partial-fill).
• 89/89 existing adagents-manager.test.ts tests pass.

Test plan

• Schema-level validation of emit shapes
• Client-side logic tests for saveAgent / serializer / block helpers
• Existing adagents-manager test suite green
• Manual smoke in /adagents/builder after deploy: add agent in each of the three modes, copy JSON, paste into validator
• Manual smoke: import v2 file with bare entries → red ⚠️ badge appears → copy is blocked

🤖 Generated with Claude Code