plan(sdk): harden malformed-success decode errors

[samuv]

Summary

• Define the TypeScript SDK's successful-response decoder boundary so malformed unary HTTP and ordinary SSE payloads cannot surface response content through ProtocolError.cause.
• Preserve body-read, server, authentication, fetch/network, abort, cancellation, and stream/control behavior.
• Record exact safe metadata, messages, lifecycle proofs, and documentation ownership before implementation.

Development stage

• Plan / Interface — Bounded/Architectural behavioral and exact-interface contract; no implementation
• Implementation — based on an approved, merged Plan / Interface PR
• Combined — compact one-task Bounded/Architectural exception; no separate plan PR
• Spike / Routine — acceptance-plan spine exempt

Contract linkage

• Work classification: Architectural
• Classification rationale: changes the durable public diagnostic and security policy at the TypeScript SDK HTTP successful-response boundary
• Decision record: docs/adr/0348-typescript-sdk-malformed-success-decoding.md
• Human waiver of spine: Yes — the directing user explicitly authorized the Implementation PR as the next gh stack layer without waiting for this PR to merge; neither PR is authorized to merge here
• Acceptance plan: docs/acceptance/sdk-malformed-success-decoding.md
• Human decisions resolved and recorded: Yes
• Plan / Interface PR: plan(sdk): harden malformed-success decode errors #1698
• Approved commit baseline: absent by explicit human exception; the stacked implementation will use this PR's exact committed contract
• Combined/exemption rationale: N/A — delivery remains Split

Interface conformance

• Successful-response JSON, well-known-type, and protobuf decode failures retain only SDK-authored messages plus code, HTTP transport, status, and a supplied request ID; they have no own cause property.
• Post-header body-read failures and existing server, authentication, transport, abort, cancellation, and stream/control semantics retain their established causes and classification.
• No protobuf, Go API, tool, CLI/config, event, persistence, or public TypeScript signature changes are proposed.

Issue relationship

Relates to #1694

Type of change

• Behavioral/interface plan
• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation/process
• Other (describe):

Test plan

Baseline checks

• Acceptance-plan checker
• Linting (task lint)
• Offline test suite (task test)
• Offline demo (go run ./cmd/mecademo)
• Markdown changed: docs generation/link checks (CGO_ENABLED=0 task docs)
• User docs/user-facing behavior changed: site build (task site:build)
• Guarded engine API affected: compatibility check (task api:check)
• Intentional engine API change: task api:update + engine/CHANGELOG.md
• Landed plan: strict acceptance trace (task ac-trace-strict)
• Final implementation review: /panel-review

task docs requires CGO_ENABLED=0 in this worktree because the host Xcode/macOS SDK linker rejects its own arm64e.x1-* architecture set; all documentation generation and strict link checks pass with CGO disabled.

Changes

File	Change
docs/acceptance/sdk-malformed-success-decoding.md	Scenario-first contract and exact acceptance proofs
docs/adr/0348-typescript-sdk-malformed-success-decoding.md	Durable malformed-success diagnostic/security decision
docs/acceptance/README.md, docs/adr/README.md	Plan and ADR index entries

User-facing change

None in this PR; it defines the contract for the stacked implementation.

Special notes for reviewers

The decoder boundary begins only after a unary body has been acquired. Response.json() combines body acquisition with JSON parsing, so the implementation must split response.text() from JSON.parse() to avoid stripping causes from body-read/network failures.