Agent and flow config as code with ensure()

Your agent's system prompt belongs in your repo, reviewed and versioned like the rest of your code. The SDK now has a first-class way to keep the platform in sync with it.

• defineAgent and defineFlow. Pure, typed constructors that validate a definition locally against the canonical schema, with no I/O.
• agents.ensure and flows.ensure. An idempotent converge verb: make the platform match this definition, and no-op if it already does. The steady state is one tiny hash-only request with no writes and no version churn.
• Content-hash idempotency. The server computes the hash over its canonical normalized form and returns it on every call, so repeated CI runs never show phantom diffs. Changes create an immutable version snapshot; history is never mutated.
• Drift detection for CI. ensure(def, { dryRun: true }) reports create, update, or none without writing, so a PR check can fail on drift. Dashboard edits are tracked and surface as a 409 conflict unless you pass onConflict: 'overwrite'.
• pull to absorb edits. Read the platform's current definition and provenance back into your repo, then review the dashboard change as a git diff.

Add release: 'publish' to point the published version at what CI just shipped.