feat: align and harden Lite CLIs for Open Server

[SeaOceanO]

Summary

• align the Python and TypeScript Lite CLIs with current Open Server Direct, Group, attachment, registration, session, and Sync V2 response shapes
• preserve retry-safe pending operations, including legacy group.create digests, advertised member limits, attachment abort/commit recovery, and real cross-process state locking
• keep both implementations independent while sharing the same public command contract, handle/DID resolution rules, input errors, and ordinary transport-protected messaging behavior
• accept validated Open Server Group receipts and attachment response extensions without weakening identifier, digest, size, expiry, URL, header, or ticket-binding checks
• remove unused Python Typer scaffolding and repair the remote Group/attachment E2E runner wiring without adding new runtime modules

Verification

• uv run ruff format --check .
• uv run ruff check .
• uv run mypy src: 37 source files clean
• uv run pytest: 166 passed, 1 skipped, 7 deselected
• uv run pytest -m repo_contract tests/test_ts_wave1_contracts.py: 7 passed
• uv build: sdist and wheel built
• pnpm install --frozen-lockfile
• pnpm format:check
• pnpm lint
• pnpm typecheck
• pnpm test: 101 passed across 15 files
• pnpm build
• clean Node 20.11 install: format, lint, typecheck, 101 tests, and build passed
• uv run python scripts/test_all.py: both independent suites passed
• pnpm audit --prod --audit-level high: no known vulnerabilities
• Python and TypeScript version/help plus both remote E2E --help entry points passed
• git diff --check

Scope and residual risk

• Python and TypeScript continue to use separate local state directories and do not invoke one another.
• Default tests do not contact or clean a remote server.
• The destructive live Open Server E2E was not rerun for this final head. Earlier self-hosted normal-path validation covered registration, Direct/Group text, and Direct/Group single attachments; this PR adds regression fixtures and runner-construction coverage for the response shapes found there.
• Full Linux/Windows/macOS CI coverage and extreme malformed-response hardening remain follow-up work, not blockers for the deliberately small Lite CLI.

[SeaOceanO]

Ready for maintainer merge.

• Head: 14b2bab68e2b38702de45cb6909c6779208c4513
• Python CI: passed
• TypeScript CI: passed
• Merge state: clean and mergeable
• Recommended method: squash merge

The PR author account has read-only access to the upstream repository, so an upstream maintainer must perform the final merge.