fix(web): align chat with the current Core contract

[sam2tom]

Summary

• restore the documented agents=v1 Session message, steering, cancellation, and function-result event flow
• require exact HTTP 204 admission for event writes, keep uncertain payload/idempotency state for explicit unchanged manual retry, and never retry automatically
• remove the private execution-readiness gate that blocked the current public chat contract
• remove the top-level Environments destination and Environment template/key entries because Core exposes no corresponding public list or management APIs
• retain the exact read-only Environment projection for an already selected self_hosted Session
• refresh the immutable Parsar compatibility audit to d91ba48

Why the original gate changed

The live Core audit established that Session event submission is the current versioned public contract. The absence of a separate readiness resource does not make those documented writes unsupported; runtime, model, provider, or credential failures remain visible through durable Session/Turn/Item state and are never treated as readiness proof.

This supersedes the original fail-closed plan in #24; it does not claim that plan's negative-write acceptance criteria were implemented.

Validation

• pnpm check (67 root tests, 50 agents-client tests, 344 Web tests, typecheck, and production build)
• pnpm test:acceptance (41/41 passed against the isolated fixture Core)
• git diff --check
• real local Parsar d91ba48 flow: Web -> Agents API -> daemon -> Codex 0.153.4 -> provider -> assistant output, confirmed interactively; provider credentials remained server-side and were not committed

Scope

Web/client/docs only. No Parsar source change, deployment, branch deletion, or credential material.