feat: single-source cross-app wire contracts in @boocode/contracts (v2.7.13)

Move all hand-synced cross-app wire contracts into one built workspace
package, @boocode/contracts, consumed by server/web/coder/coder-web via
workspace:* + a per-subpath exports map. The ws-frames and provider-config
Zod schemas are schema-first (z.infer); MessageMetadata, ErrorReason,
AgentSessionConfig, the provider snapshot types, and WorktreeRiskReport are
each single-sourced. Deletes the byte-identical copies and their parity
tests, fixes a live AgentSessionConfig drift (coder dead copy removed,
unified to the web required/nullable shape), removes the dead pending_change
WS arms in the fallback SPA, and inverts the build order (contracts builds
first) across root build, Dockerfile, and the coder deploy docs. Reverses
the shared-package decision declined in v2.5.12.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/contracts/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@boocode/contracts",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./ws-frames": {
+      "types": "./dist/ws-frames.d.ts",
+      "default": "./dist/ws-frames.js"
+    },
+    "./provider-snapshot": {
+      "types": "./dist/provider-snapshot.d.ts",
+      "default": "./dist/provider-snapshot.js"
+    },
+    "./provider-config": {
+      "types": "./dist/provider-config.d.ts",
+      "default": "./dist/provider-config.js"
+    },
+    "./message-metadata": {
+      "types": "./dist/message-metadata.d.ts",
+      "default": "./dist/message-metadata.js"
+    },
+    "./worktree-risk": {
+      "types": "./dist/worktree-risk.d.ts",
+      "default": "./dist/worktree-risk.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "typescript": "^5.5.0",
+    "vitest": "^3.2.4"
+  },
+  "license": "MIT"
+}