feat(sdk): add typed clients and reliable message receipts - #5

Provide explicit synchronous and asynchronous REST clients and reliable message/form integration for Pine. PineAI returns synchronous REST values; AsyncPineAI owns asynchronous REST and realtime access. Injected HTTP clients remain caller-owned.

• Add typed identity, authorization-ticket, session, message-receipt, and Outcome resources with per-request bearer isolation and safe errors. Session listing defaults to ensure_copilot=false (requires backend support).
• Send ordinary messages over HTTP with actual received/delivered/delivery_failed status. Never retry writes automatically; a timeout can leave persistence unknown.
• Add async submit_form_response: re-read the original form, preserve its message/request IDs, validate and encode fields like the web app. Use the existing direct session:message_status receipt to obtain the persisted reply ID, then wait for matching delivery. No additional backend sender echo or form validation changes are required.
• Keep known received status across timeout/disconnect/later errors. One attempt per original-form key per connection prevents late receipts being mistaken for a new attempt; reconnect does not replay writes. History waits match both session and request IDs and clean up on failure/cancellation.
• Prepare 0.5.0rc1 source only and document migration from published 0.3.3 and the unreleased 0.4.0 changes. Typed session results and removal of synchronous realtime wrappers are breaking changes; existing pinned installations are unchanged, but broad downstream version constraints must be reviewed before publication.

Validation: 131 offline tests and Ruff passed locally on Python 3.14.7, including delayed received/delivered, wrong reply IDs, failures, concurrency, disconnect/cancel and reconnect. CI covers Python 3.10–3.14 and distribution builds. Live MCP -> SDK -> restored original backend form protocol -> local Agent1 regression observed received then delivered, zero sender form echoes, the persisted reply ID and Agent1 confirmation. MCP history excluded L2/L3 synthetic fixture values. No package publication or phone call was performed.

Keep Draft for review. Ticket/identity APIs require the matching backend authorization update; form submissions use the preexisting backend protocol. The legacy synchronous form helper is deprecated because it does not recover and verify the original form association. Backend form validation, sender events and logging remain unchanged.