Add PATCH/DELETE transport and coding-agent-config CRUD clients

[tt-le]

Changes

Stacked on #268 (which is stacked on #267) — review those first. This PR's diff includes them until they merge.

The write-side API plumbing for ucode apply (#PR3b). No CLI wiring and no interactive flow: transport helpers plus three clients, scoped the same way the read client landed in #263.

Transport. databricks.py had _http_get_json/_http_post_json but no PATCH or DELETE. Rather than a third and fourth near-copy of the same 40 lines of error handling, the body-sending path is factored into _http_send_json(method, ...) and the verbs become thin wrappers. _http_post_json's behavior is unchanged.

DELETE needed one real difference: its success response is google.protobuf.Empty, which arrives as {} or an empty body depending on the gateway. An empty body would otherwise be reported as "response was not valid JSON", so allow_empty_body treats it as success.

Clients for the three admin RPCs, all workspace-admin gated server-side:

Client	Verb	Note
create_coding_agent_config	POST	v0 allows one config per workspace, so returns ALREADY_EXISTS when one exists
update_coding_agent_config	PATCH	Preferred over delete-then-create — see below
delete_coding_agent_config	DELETE	Returns only a reason; there's no payload worth handing back

Why PATCH rather than delete-then-create. The original plan was delete-then-create, since Create returns ALREADY_EXISTS. But UpdateCodingAgentConfig exists and every field ucode authors is in the handler's MUTABLE_UPDATE_MASK_PATHS. Delete-then-create has a window where the workspace has no managed config: if the create failed there, every developer would silently fall back to their own settings until someone re-ran the command. The server applies the mask inside a single entityStore.update, so a failed PATCH leaves the current config intact.

MANAGED_CONFIG_UPDATE_MASK_PATHS is every field ucode's manifest can set. The server requires a non-empty mask and rejects paths outside its mutable set; this is that set minus what ucode doesn't author — budget_id (deprecated for budget_policy.budget_id, and rejected on write) and default_options/tiers (the legacy model-only shape). Sending every path ucode owns, not just the populated ones, is what lets a re-run clear a field the admin removed: the server merges per path, so an omitted path leaves the old value in place.

Validation gaps found against the server

Three things surfaced from reading the validation this manifest is written for (universe #2365441). All are reachable through --from-file even though the wizard can't produce them.

— budget_policy.budget_id must parse as a UUID. The handler requires it; ucode only checked non-empty, so a hand-written "budget_id": "eng-budget" passed local validation and failed at the API. Local pre-flight exists precisely to spend the round trip on real problems.

— Tier positions are now 0-based. The server indexes with zipWithIndex, so ucode's tiers[1] and the API's tiers[0] described the same tier — an admin reconciling the two messages would look at the wrong one.

— The deprecated top-level budget_id is never emitted. The serializer already only writes budget_policy.budget_id; this pins behavior that was correct by construction rather than by intent.

Test fixtures used short placeholders ("b", "budget-1") where a real budget_configuration_id would be, so those are now UUIDs — 20 occurrences. list_workspace_budgets only ever returns real ones, so the fixtures described input the wizard can't produce.

Testing

uv run pytest — 1354 passed, 6 skipped. 21 new cases.

The mask is checked against serialize_managed_config's actual output rather than a restated list, so adding a manifest field fails the test instead of shipping a mask that can't clear it.

Mutation-verified six ways — dropping allow_empty_body, dropping the update_mask, dropping one mask path, dropping the UUID check, reverting to 1-based indices, and emitting the top-level budget_id each fail a specific test.

This pull request and its description were written by Isaac.

The base branch was changed.