v2.42.0

First-class orgs — client surface (v2.42.0)

Wraps the shipped gateway v1.82 first-class-orgs: create, name, and claim organizations, and provision into them. Breaking (pre-launch, no compat shim): the org client surface moves from billing_account_id to org_id. Tracks #451.

SDK (@run402/sdk)

• Collection + instance split, mirroring r.project(id):
  • r.orgs.create({ displayName? }) / r.orgs.list() / r.orgs.whoami()
  • r.org(id).get() / .rename(name | null) / .members.* / .invites.* / .audit()
• Wallet-org claim - r.operator.claimWalletOrg.challenge() + .submit() (dual proof: control-plane session bearer + a fresh SIWX wallet signature), plus Node claimWalletOrg() / signWalletOrgClaim() that run the whole challenge → sign → submit dance.
• ProvisionOptions.orgId - provision into an existing org.
• OrgMembership is now { org_id, display_name, role, status }.

CLI (run402)

• run402 org create | get | rename (and <billing_account> → <org> throughout).
• run402 provision --org <id>.
• run402 operator claim-wallet-org - challenge → sign → claim, with the multi-org select_org round-trip and STEP_UP_REQUIRED guidance.

MCP (run402-mcp)

• create_org / get_org / rename_org; the org tools and provision now take org_id.

Agent docs (llms-cli.txt, llms-sdk.txt, llms-mcp.txt, SKILL.md) updated. The wallet-org claim is CLI + SDK only (it needs a browser loopback login + passkey step-up).