fix(CLI-40,CLI-41,CLI-44): exact-secret scrub, uniform malformed-reply contract, Go terminal-error mislabel

CLI-40: port the exact-secret credential scrub to Rust/Java/.NET (Go/Python
already did it). AuthenticateUser/WriteSecured(2) helpers now redact the exact
caller-supplied secret from any surfaced error, as defense-in-depth on top of the
by-construction guarantee. Rust hand-writes a redacting Debug (derived Debug would
leak the reply); Java/.NET rebuild the same exception type with the redacted
message and do not carry the secret-bearing original forward (so ToString/stack
traces stay clean too).

CLI-41: uniform malformed-reply contract for AuthenticateUser/ArchestrAUserToId/
AddBufferedItem across all five clients — typed payload, else a present int32
return_value, else a typed malformed-reply error. Fixes Go/Java silent-0, .NET
NRE, and Rust's own internal inconsistency.

CLI-44: the Go event goroutine's Recv-error path now uses a non-blocking
sendTerminalEventResult on the reserved slot, so a genuine terminal stream error
is reported as itself instead of being mislabeled ErrSlowConsumer under overflow.

Riders from the CLI-37/38 review: (a) .NET ToDiagnosticSummary and Python
_mxaccess_message surface the raw success member (diagnostics-only parity with
Rust); (b) the status-conversion fixture carries an independent wantSuccess
boolean and the Go/.NET fixture tests assert against it instead of recomputing
the formula under test.

Shared fixtures (authenticate-user.{echoed-credential,missing-payload,
return-value-only}.reply.json) + manifest + ClientBehaviorFixtures.md +
ClientLibrariesDesign.md updated in the same change. Tracking: CLI-40/41/44 -> Done.

docs/ClientLibrariesDesign.md

@@ -126,11 +126,22 @@ rules across all five clients (see
 failing before a prior `AuthenticateUser` + `AdviseSupervisory` surfaces the
 native failure unchanged — the helper does not pre-validate or reorder it.
 
+**Malformed-reply extraction:** the id/handle-returning helpers
+(`AuthenticateUser`, `ArchestrAUserToId`, `AddBufferedItem`, and the handle
+extractors) follow one contract across all five clients — prefer the typed
+payload; fall back to `return_value` only when it is present with the expected
+int32 variant; when neither is present, raise a typed malformed-reply error.
+They never surface a proto3 default `0` and never throw a null-reference (CLI-41).
+
 **Credential handling:** `AuthenticateUser` credentials and `WriteSecured`
 secured payloads route through each client's secret-redaction seam so they never
 reach logs, exception text, or `ToString`/`Debug`/`Display` — the value is carried
-only on the wire. Each client's test suite asserts a distinctive credential is
-absent from any surfaced error.
+only on the wire. In addition to that by-construction guarantee (exceptions carry
+reply-derived text, not the request), every client scrubs the **exact** secret
+values it was called with from any surfaced error text as defense-in-depth, so a
+gateway or MXAccess diagnostic that echoes a credential back cannot leak it
+(CLI-40). Each client's test suite asserts a distinctive credential is absent
+from any surfaced error and that the redaction marker is present.
 
 Shipped in all five clients (.NET / Go / Rust / Python / Java).