feat(sdk): publish typed runtime model catalog results

[andrewkcchung]

Why

Runtime model catalogs cross SDK, management, and web-client boundaries. Returning unvalidated any[] values makes every consumer reinterpret the wire format and allows malformed provider responses to fail much later. A provider-neutral public contract gives all model providers and clients one stable boundary without prescribing provider-specific catalog policy.

What changed

• Add exported runtime model catalog wire and normalized types.
• Validate required model identity fields and normalize safe optional fields.
• Preserve opaque capability values so the SDK does not impose provider policy.
• Apply normalization consistently in management operations and web-client methods.
• Add generated-client consistency, runtime contract, package-export, and consumer type coverage.

Behavioral proof

Command:

npm run build --workspace=packages/sdk
node --test packages/sdk/test/unit/model-catalog-contract.test.mjs
npx tsc -p packages/sdk/test/type/model-catalog/tsconfig.json --noEmit

• Red — test-only patch on main: The contract test/type consumer failed because main had no public model-catalog module or typed normalized result.
• Green — this branch: SDK build and consumer type-check succeeded; 5 contract tests passed.

Risk assessment

Relative risk: Low

The change is confined to SDK type normalization and client result validation. It does not alter persistence, authentication, orchestration, or provider selection. The main compatibility exposure is that malformed catalog entries without required identity fields now fail explicitly; runtime, generated-client, package-export, and consumer type tests cover that boundary.

Review focus

• Confirm the required identity fields are the minimum stable wire contract.
• Confirm optional normalization does not discard provider-owned opaque capability data.
• Review the deliberate compatibility change: malformed catalog entries missing identity now fail explicitly instead of flowing through as any.
• Confirm generated operation methods and handwritten web APIs expose the same validated shape.