feat(forward): add Decision APIs - #26

Summary

Add Forward Decision creation, retrieval, and cursor listing so applications can evaluate explicit state or accessible Session history without constructing raw HTTP requests. Creation supports choice and score questions, an Idempotency-Key, and typed results including refusal answers and context truncation/token-estimate metadata.

Why

The deployed Forward API exposes three Decision endpoints that are missing from the SDK. This change follows the service implementation and reuses existing PAT/SAT authentication, transport, errors, and pagination. Exactly one of state and session_id is accepted by the service; model selection remains server-side.

Verification

• uv run make lint
• uv run make typecheck
• uv run make test: 3814 passed; 61 integration cases deselected in the ordinary offline run
• uv run make docs-check
• uv run make build
• python -m examples.forward.decisions --help
• Account-backed validation: sync and async clients, CN and Global, PAT and ServiceAccountCredential (8 combinations)
• Synchronous and asynchronous public APIs remain aligned

Live validation used strict response validation and exercised state and Session creation, boolean false, score zero, string choices, identical-request replay, changed-body 409, retrieval, and both cursor directions. Two async SA verification attempts initially failed because the separate acceptance harness called close instead of aclose on the credential; both were rerun successfully after correcting the harness. No SDK change was needed. Temporary Session/Template/Identity/Environment resources were cleaned up. Long-history truncation and Identity-scoped SAT isolation were not exercised live.

Public entry points: client.decisions.create, retrieve, and list on Forward and AsyncForward.

Impact

• Public API changed additively; existing resources and shared transport are unchanged
• User-facing change recorded under Unreleased in CHANGELOG.md
• Generated API documentation, runnable example, and opt-in live-test instructions updated
• Forward contract fixtures and API inventory updated
• Go, Python, and TypeScript parity considered
• No credentials, .env.live, live logs, or generated test output committed

No breaking changes or migration steps. Decision records have no delete endpoint and expire under server retention. Live tests require explicit write/execution/Decision gates and stay outside ordinary PR tests. This PR does not bump the package version.