fix(registry): require declared agent type + auto-backfill primary_brand_domain

[EmmaLouise2018]

Summary

• save_agent (Addie MCP tool): type now required in input schema (8-value enum: brand, rights, measurement, governance, creative, sales, buying, signals). Persists on insert; updates on re-save when an owner corrects an earlier wrong type.
• POST /api/me/agents: returns 400 type is required on missing/invalid/'unknown'. PATCH /api/me/agents/:url: returns 400 invalid_type on invalid; omission preserves existing.
• Mutation helper backfills member_profiles.primary_brand_domain atomically with the JSONB write (under the same FOR UPDATE row lock) when the column is null AND every agent in the resulting array agrees on one hostname (after stripping www.). Conflicts are skipped — picking one would mis-key registry lookups.
• Operator endpoint (/api/registry/operator): drops silent || "unknown" fallback. Out-of-enum values still serialize as "unknown" to preserve OperatorLookupResultSchema, but a warn-level log fires with domain, url, storedType, profileSlug so ops can catch corrupt rows.
• OpenAPI: new MemberAgentTypeInput enum (sans 'unknown'); MemberAgentInputSchema.type now required; read-side MemberAgentSchema.type tightened from optional to required (matches what the operator route always emits).
• Addie's intake script (behaviors.md): "do not ask about agent type" replaced with "always ask, never guess." Owner declares; if the user describes capabilities, Addie may suggest a fit but the user must confirm before save.

Why

Caught in production: a member registered an agent at https://www.harvingupta.xyz/api/mcp and saw it correctly in /dashboard/agents, but GET /api/registry/operator?domain=harvingupta.xyz returned { member: null, agents: [] }. Two compounding gaps:

1. The agent's stored type was absent. save_agent's schema explicitly did not accept a type field — it relied on a server-side capability-snapshot resolution that silently produced no value when the probe failed. POST /api/me/agents accepted Partial<AgentConfig> and never validated type either. The operator endpoint masked the missing field with type: ac.type || "unknown", so bad data flowed straight through to the public response.
2. primary_brand_domain was NULL. Agent registration writes member_profiles.agents JSONB but never backfilled primary_brand_domain, and the public operator lookup keys exact-match on that column. Result: a registered agent that the profile owner could see in the dashboard but no peer could discover via the registry.

Fixing both gaps at once because they're tightly coupled — the type guess and the missing brand-domain backfill were each independently sufficient to make the agent invisible.

Behavior change

POST /api/me/agents and save_agent now reject writes that don't declare type. Audit of write surfaces:

• Dashboard "+ Register agent" (server/public/dashboard-agents.html) — redirects to Addie chat; Addie's updated intake script asks for type before calling save_agent. ✅ unaffected
• Addie save_agent MCP tool — schema enforces type at the JSON-RPC layer; runtime check is the suspenders. ✅ unaffected for new conversations; existing prompts that paste-it-all need to include type
• POST /api/me/agents REST — any external caller posting { url, name, visibility } without type will start getting 400. Quantify before merge: search downstream SDK callers (@adcp/client, internal storefront integrations) for unset type. None found in this repo's tests; updated 14 test sites here to declare type: 'sales'.
• PATCH /api/me/agents/:url — omitting type preserves the existing value (no behavior change for existing callers).

Migration

Existing rows handled by a manual migration on the prod pod (deliberately out of release_command so it doesn't auto-fire on deploy):

• Backfilled primary_brand_domain from the unanimous agent hostname.
• Defaulted any agent with missing/invalid type to sales (per owner instruction).

The bulk-default-to-sales is a guess applied at migration time — the very pattern this PR forbids for new writes. Tracked as a follow-up: surface a "your agent's type was bulk-set, confirm or correct" banner on /dashboard/agents for the affected cohort. See #4236.

What changed (quantified)

• 8 valid AgentType values enforced at input; 'unknown' reserved for server-side smuggle protection only.
• 3 write surfaces tightened: POST /api/me/agents, PATCH /api/me/agents/:url, save_agent MCP tool.
• 1 read surface tightened: MemberAgentSchema.type from optional → required (matches operator route behavior).
• 1 silent || fallback removed; replaced with a warn-level structured log on corrupt rows.
• 14 existing test POSTs updated to declare type (covers both member-agents-api and member-agents-auto-bootstrap integration suites).
• 7 new integration tests pinning the new contract (see test plan).
• 6 source files + 1 changeset + 2 test files = 9 files changed.

Out of scope

• Surface bulk-defaulted agent types to owners for confirmation #4236 — surface the bulk-defaulted-to-sales cohort to owners for confirmation. Migration shortcut, not a per-write bug; deferred to keep this PR's scope to code-only.
• Operator endpoint: surface corrupt-row sentinel instead of silent 'unknown' #4237 — _diagnostics.type_source sentinel on operator-endpoint responses so consumers can distinguish "snapshot contradicted declaration" from "corrupt row." Wire-visible additive field; deferred to v6 / 4.0 track.

Test plan

• tsc --noEmit -p server/tsconfig.json — clean
• vitest run server/tests/unit — only 5 pre-existing failures (taxonomy enum sync, missing storyboard yaml); confirmed against main by stashing changes; none touch modified files
• Build passes (npm run build)
• Updated 14 existing integration test POSTs to declare type: 'sales' so they exercise the new gate cleanly rather than tripping it
• Added 7 new integration tests in tests/integration/member-agents-api.test.ts:
  • POST 400 when type is missing
  • POST 400 when type is 'unknown' (reserved server-side)
  • POST 400 when type is out-of-enum (e.g. legacy 'seller')
  • PATCH 400 invalid_type, omission preserves existing, valid swap updates
  • POST backfills primary_brand_domain from agent hostname when null + unanimous
  • POST does NOT backfill when agents disagree on hostname
  • POST does NOT overwrite primary_brand_domain when already set
• Integration tests in CI (require live Postgres): tests/integration/member-agents-api.test.ts, tests/integration/agent-visibility-e2e.test.ts, tests/integration/member-agents-auto-bootstrap.test.ts
• Smoke after deploy: register a fresh agent through Addie, confirm GET /api/registry/operator?domain=<owner-brand> returns the agent
• Smoke after deploy: POST /api/me/agents with no type returns 400 type is required