[AuthZ: 3/N] enforce external authorizer on agent access

[chiragjn]

Note

High Risk
Authorization behavior changes across agents, sessions, schedules, and turns—including 404 vs idempotent delete and schedule status codes—which can break clients and leak less information to unauthorized callers in TrueFoundry mode.

Overview
Enforces the process Authorizer on agent reads and management across list/get/snippets/update/delete, named-agent session creation, schedule create/run-now, and turn creation when the session references a stored agent. New agentAccess helpers filter or hide agents the caller cannot access, returning 404 for both missing and forbidden agents.

API contract tweaks: agent delete is no longer documented as idempotent (repeat delete → 404); schedule create returns 404 (not 400) when the named agent is missing or inaccessible; turn/create paths distinguish missing agent (422) vs unauthorized (404).

TrueFoundry / config: renames TrueForgeMode → TrueForgeAuthMode; limits TrueFoundry ServiceFoundry integration to non-standalone distributed config; per-request model/MCP/agent stores now require a request Context (schedule manual runs resolve turn deps from the HTTP context for caller tokens). OpenAPI, Fern YAML quote style, SDK clients, and wire tests updated for new 404 responses.

^{Reviewed by Cursor Bugbot for commit 509b177. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 509b177

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 209650e. Configure here.}