refactor: collapse the Solution two-API split onto solution.Client (#295)

[antoinetoussaint-byte]

Closes#295.

The four remaining tasks from #295 do not depend on this change and cannot be done in core (they need the cross-repo CLI caller); they are carried forward in #297 so closing #295 on merge drops nothing.

Summary

• Settles the one method-policy open question that does not depend on a real caller existing: the two-API split (task impr: current with * instead of another field #2). solution.Client makes the operation ceiling a required, type-level argument; the exported WithCeiling let any caller stamp a ceiling onto a raw solutionv0.SolutionClient and bypass that guarantee. This unexports WithCeiling so Client (solution.NewClient) is the single path that can dispatch an effectful Solution RPC — a caller holding the raw generated client can only ever reach the least-privilege default ceiling (enough for the read-only advertisement, by design), so every mutating RPC fails closed.
• Makes Client's ceiling guarantee intrinsic: each method checks the declared policy against the ceiling before dispatch, so it holds even on a connection whose dial did not install EnforcingClientInterceptor (which NewClient cannot introspect). The interceptor stays as defense in depth and to gate callers that reach for the raw client.
• The interceptor's default-ceiling denial message and the surrounding docs now point callers to solution.Client instead of the removed solution.WithCeiling.

Not addressed here (tracked in #297)

The issue itself states every remaining open question "only becomes answerable once a real caller exists," and the caller — the CLI solution command group (task #1) — lives in the separate codefly binary repo, not in core:

• Task impr: check for references #1 (wire the first host caller): cross-repo; there is no CLI/solution command package in core to wire.
• Task impr: public -> visibility on endpoint #3 (ceiling vocabulary): the Inspect < Scaffold < Render < Publish tiers are internally coherent (guarded by TestOperationCeilingsAdmitExactlyTheirRPCs); whether a package+render deploy wants a tier below CeilingPublish can only be judged against the real caller's operations.
• Task #4 (Render network assumption):Render is annotated REGISTRY_READ (set in solution: declare & enforce per-method effect/network policy on the Solution contract #289). Confirming or flipping it to OFFLINE requires the host executor implementation, which is not in this repo.
• Task clean: giant cleanup + testing #5 (ceiling provenance): deriving the ceiling from an authorized operation/principal/environment needs the consumer to shape it at a trusted chokepoint.

Making Client canonical now — before task #1's caller exists — is the right sequencing: there is no consumer to break, and the future caller is forced onto the guaranteed path.

Test plan

• go build ./...
• go vet ./solution/... ./agents/manager/...
• go test ./solution/... ./agents/manager/...
• TestClientRequiresCeilingPerCall covers the canonical Client path (Create admitted under a scaffold ceiling, Package denied before the wire).
• TestClientEnforcesWithoutDialInterceptor covers a Client over a connection with no interceptor: Create admitted, Package refused before the wire by Client itself. Verified failing against the pre-fix code.
• TestEnforcingClientInterceptorDefaultsToLeastPrivilege covers the raw-client path that can no longer stamp a ceiling: read-only advertisement admitted, mutating RPC denied with a message naming solution.Client.

🤖 Generated with Claude Code