chore(oss): audit the server package and resync the SDK mirrors

Split the 657-line operation service into eor, submit, and verify
modules, add the AGENT_REVOKED and KEY_RETIRED codes the Backend already
emits, and condense every multi-line comment. Mirror Node, Python, and
Go at 2.1.0 with the deep-health 503, non-idempotent retry, rotation
grace, and path-encoding fixes. Document which routes and response
fields the self-hosted server does not provide.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

sdks/node/test/cli-security.test.mjs

@@ -18,6 +18,7 @@ async function runCli(args, homeDir) {
         ...process.env,
         HOME: homeDir,
         USERPROFILE: homeDir,
+        XDG_CONFIG_HOME: path.join(homeDir, '.config'),
       },
       stdio: ['ignore', 'pipe', 'pipe'],
     });

sdks/node/test/guard-template.test.mjs

@@ -6,7 +6,7 @@ import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
 
-import { generateGuardScript } from '../dist/plugins/hook-template.js';
+import { generateGuardScript } from '../dist/plugins/guard-template.js';
 
 const AGENT_ID = 'agent-1';
 
@@ -26,6 +26,7 @@ async function createFixture(status) {
   await writeFile(
     path.join(agentDir, 'config.json'),
     JSON.stringify({ agent_id: AGENT_ID, base_url: `http://127.0.0.1:${address.port}` }),
+    { mode: 0o600 },
   );
 
   const scriptPath = path.join(homeDir, 'guard.cjs');
@@ -91,6 +92,7 @@ test('cached frozen status keeps the blocking exit code', async () => {
     await writeFile(
       path.join(fixture.homeDir, '.elydora', AGENT_ID, 'status-cache.json'),
       JSON.stringify({ status: 'frozen', cached_at: Date.now() }),
+      { mode: 0o600 },
     );
 
     const result = await runGuard(fixture.scriptPath, fixture.homeDir);

sdks/node/test/letta-runtime.test.mjs

@@ -60,7 +60,7 @@ async function installedHandlers(fixture) {
 }
 
 test('Letta guard accepts active agents with native exit semantics', async () => {
-  const api = await startApiServer('active');
+  const api = await startApiServer({ status: 'active' });
   const fixture = await createFixture({ baseUrl: api.baseUrl });
   try {
     assert.equal((await fixture.install()).code, 0);
@@ -82,7 +82,7 @@ test('Letta guard accepts active agents with native exit semantics', async () =>
 test('Letta guard propagates frozen and revoked states through exit code 2', async (t) => {
   for (const status of ['frozen', 'revoked']) {
     await t.test(status, async () => {
-      const api = await startApiServer(status);
+      const api = await startApiServer({ status });
       const fixture = await createFixture({ baseUrl: api.baseUrl });
       try {
         assert.equal((await fixture.install()).code, 0);