Sync the package checks and docs with the MiniMax Code 3.1.2 Mini App contract

[MyPrototypeWhat]

Summary

Syncs the package checks and contributor docs with the MiniMax Code 3.1.2 Mini App contract (Agent API, pop-out window, loopback authentication).

npm run check

Change	Level
miniapp.json accepts agentAccess (only "session.run") and agentConcurrency (integer 1–32)	errors when malformed
surface.window validated with the Host's rule set (whitelisted fields, 200–10000, min* ≤ size, booleans, transparent needs frame: false)	errors when malformed
plugin.json accepts agents (agents/<name>.md, must exist); other unknown fields remain errors because clients before 3.1.2 reject them	errors when malformed
surface.path / MCP endpoint path under the Host-reserved /__mavis/	error MINIAPP_ROUTE_RESERVED
Node file creates an https / http2 / net / tls server (the loopback guard covers only node:http)	warning NODE_UNGUARDED_SERVER
Node file mentions a /__mavis/ route	warning NODE_RESERVED_ROUTE
Package uses a feature that needs a newer client, and the README's ## Tested environment names no MiniMax Code version at or above it	warning README_MIN_VERSION_MISSING

Minimum versions live in one table (FEATURE_MIN_HOST_VERSION in scripts/lib/contract.mjs); every new feature is 3.1.2. CI is unchanged and runs these through npm run check.

Docs and example

• docs/package-contract.md: new fields, /__mavis/, and a "Minimum client version" section.
• docs/runtime.md: context.agent and "Loopback authentication".
• docs/agent.md (new): Agent grant, sessions, calls, interaction, events, errors.
• docs/client.md (new): window.mcode.miniapp.message, agent, and the proposed window handle.
• docs/security.md: loopback rules; Agent turns (approvals stay with the user, prompt input is untrusted).
• AGENTS.md, CONTRIBUTING*.md, root READMEs: new docs and the minimum version requirement.
• examples/hello-miniapp: miniapp-api.ts replaced with the 3.1.2 Host snapshot; client-api.ts added for page type checking. The only local edit is the header line, which now points to docs/client.md. The example uses none of the new features, so its tested environment stays at 3.0.73.

Verification

• npm run check: 69 tests pass. All 9 plugins and the example produce the same results as on main: no errors, and only the existing README_HEADING_MISSING warnings on mcode-token-usage-board and mcode-usage-monitor.
• Ran scripts/validate.mjs on a throwaway copy of the example that declares every new field. It reports one README_MIN_VERSION_MISSING, which clears once the README names 3.1.2. With a reserved route, framed transparency, agentConcurrency: 64, and an https.createServer, it reports the matching three errors and one warning.
• surface.window: 314 cases compared against the Host's own validateMiniAppSurfaceWindow, 0 mismatches. agentAccess / agentConcurrency were compared against a copy of the Host's two checks, not the Host function itself, because its reader cannot be imported on its own.
• tsc --checkJs (non-strict) passes for the example entry with the new miniapp-api.ts, and for client-api.ts.

Not verified

• Nothing was installed or run in a real MiniMax Code 3.1.2 client; 3.1.2 is not released yet.
• NODE_UNGUARDED_SERVER and NODE_RESERVED_ROUTE are pattern checks. They can miss renamed imports and flag comments, so they are warnings.

Merge timing

Clients up to 3.1.1 reject packages that declare the new fields. Please merge once 3.1.2 is released.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}