feat(search): add typed sync and async resource search - #31

Summary

Add typed resource Search APIs for Forward Environments, Skills, Vaults and Files, plus Managed Agents, Sessions, Deployments, Environments, Skills, Vaults, Files and Memory Stores. Search adds the required beta header, sends filters and opaque pagination cursors in the POST JSON body, and keeps Forward identity_id exclusively in the query.

Include public parameter types, manual/automatic pagination, contract and opt-in live tests, generated API documentation, README examples and Unreleased notes.

Why

The current SDK exposes List APIs but cannot express the official Search contract through typed resource methods. Existing GET/query pagination cannot safely replay Search body cursors. The new path preserves filters and request options across pages without changing List pagination.

Contracts checked on 2026-10-27: Forward Search, Managed Session Search.

Verification

• uv run make lint
• uv run make typecheck
• uv run make test
• uv run make docs-check
• Example --help smoke checks
• Account-backed integration tests run, or not required

Commands and results:

Python 3.12.7: uv run make lint; uv run make typecheck;
uv run make test: 3977 passed, 73 integration tests deselected.
uv run make docs-check: PASS.
uv run python -m examples.forward --help; uv run python -m examples.managed --help: PASS.
Release notes validation and 19 release automation tests: PASS.
CN and Global, each: QODER_RUN_LIVE=1 uv run pytest tests/integration/test_search.py -m integration -v
12 strict-response Search cases per region, 24 passed; no skipped cases.

Impact

• Public API or behavior changed
• User-facing changes added to CHANGELOG.md under Unreleased, or not applicable (explain below)
• Synchronous and asynchronous clients remain aligned
• Generated API documentation updated
• Contract fixtures updated
• Go and TypeScript parity considered
• Migration notes added for a breaking change (not applicable: additive APIs)
• No credentials, .env.live, logs, or generated test output committed

Additional context:

Live validation used existing PAT test accounts and only read-only Search requests. Ten resource types in each region returned non-empty pages and exercised the next-page request. Forward Files and Managed Deployments returned empty pages; their item decoding is covered by offline contracts. Explicit Identity scope and other documented filters are covered by offline wire tests; SAT scope was not exercised live. No resources were created or model requests executed.

Go, Python and TypeScript implement the same 12 endpoints; Python covers both sync and async clients. Internal integration and QA-package verification will follow after the source is merged into GitHub main. This PR does not change the package version or publish a release.

Companion PRs: go #30, ts #33.