feat(clients): CLI-04 typed single-item command parity (+CLI-30 unregister) — 4/5 clients

Every parity-critical single-item MXAccess command now has a typed session
helper instead of only a raw-Invoke escape hatch. Added per client:
- Phase 1: AdviseSupervisory, WriteSecured, WriteSecured2, AuthenticateUser,
  ArchestrAUserToId
- Phase 2: AddBufferedItem, SetBufferedUpdateInterval, Suspend, Activate
- CLI-30: Unregister (Rust + .NET; Go/Python already had it)

Each wraps the existing raw-command machinery (no new wire surface) and runs the
same MXAccess-level reply validation (hresult < 0 + MxStatusProxy). MXAccess
parity preserved: WriteSecured before AuthenticateUser+AdviseSupervisory surfaces
the native failure unchanged (not pre-validated/reordered). Credentials
(AuthenticateUser password, WriteSecured payloads) route through each client's
secret-redaction seam and never reach logs/exceptions/ToString/Debug/Display;
each suite asserts a distinctive credential is absent from surfaced errors. New
CLI subcommands source credentials via flag/env, never echoed.

- .NET: 21 helpers (validated + Raw), CLI subcommands, multi-secret CLI redactor.
  Build clean (0 warn), 102 passed.
- Go: 9 helpers + *Raw variants, redactSecrets seam, promoted CLI advise-supervisory
  to typed. gofmt/vet/build/test clean.
- Rust: 10 helpers incl. unregister; verified ensure_mxaccess_success runs on
  secured paths; error.rs credential scrub. fmt/check/test/clippy clean.
- Python: 9 async helpers, redact_secret seam + _invoke_redacted, CLI commands.
  145 passed.
- Shared doc: ClientLibrariesDesign "Typed Command Parity" section.

Java client typed parity is batched to windev (no local JRE); CLI-04 + CLI-30
stay open until it lands.

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

docs/ClientLibrariesDesign.md

@@ -104,6 +104,29 @@ All languages should expose the same core concepts, using idiomatic naming:
 The gateway session id and MXAccess handles must remain visible. The library may
 offer helper methods, but it must not invent alternate handle semantics.
 
+## Typed Command Parity
+
+Every command kind in the wire contract has a typed single-item session helper,
+not just a raw-`Invoke` escape hatch (CLI-04). Beyond the register/add/advise/
+remove/write family, the parity-critical single-item helpers are:
+`AdviseSupervisory`, `WriteSecured` / `WriteSecured2`, `AuthenticateUser`,
+`ArchestrAUserToId`, `AddBufferedItem`, `SetBufferedUpdateInterval`, `Suspend`,
+`Activate`, and `Unregister`. Each is a thin wrapper over the same raw-command
+machinery the bulk helpers use — it adds no wire surface — and runs the same
+MXAccess-level reply validation (HRESULT `< 0` + per-item `MxStatusProxy`) as the
+rest of the client. **MXAccess parity is preserved exactly**: e.g. `WriteSecured`
+failing before a prior `AuthenticateUser` + `AdviseSupervisory` surfaces the
+native failure unchanged — the helper does not pre-validate or reorder it.
+
+**Credential handling:** `AuthenticateUser` credentials and `WriteSecured`
+secured payloads route through each client's secret-redaction seam so they never
+reach logs, exception text, or `ToString`/`Debug`/`Display` — the value is carried
+only on the wire. Each client's test suite asserts a distinctive credential is
+absent from any surfaced error.
+
+Shipped for .NET / Go / Rust / Python; the Java client's typed parity helpers are
+batched to the windows build host (no local JRE on the primary dev box).
+
 ## Shared API Shape
 
 Each language should support this conceptual API: