fix(api): agent_action URLs must use api-host for /api/v1 paths

[mastermanas805]

Summary

Eleven agent_action strings shipped pointing /api/v1 calls at the
marketing host (https://instanode.dev/api/v1/...), which returns HTML
404 on every path. The canonical API host is api.instanode.dev.
Every LLM agent that hit one of these walls relayed a non-working URL
to the user — they would then waste a curl/POST attempt and get an
HTML 404 instead of the JSON they expected.

Live verification of the bug:

$ curl -sI https://instanode.dev/api/v1/resources | head -1
HTTP/2 404
content-type: text/html

$ curl -sI https://api.instanode.dev/api/v1/resources | head -1
HTTP/2 401
content-type: application/json

Changes

• Flip 11 sites in internal/handlers/agent_action.go (3 sites:
  AgentActionResourceAlreadyPaused, newAgentActionBindingNotFound,
  newAgentActionBindingNoEnvTwin) and internal/handlers/helpers.go
  (8 sites in codeToAgentAction) to use https://api.instanode.dev/api/v1/....
• Relax assertContract URL check in agent_action_contract_test.go
  to accept either canonical host (marketing https://instanode.dev/
  for dashboard URLs, api host for programmatic API paths). The
  docblock now spells out the two surfaces.
• Add TestAgentActionContract_APIPathsUseAPIHost — registry-iterating
  regression test that asserts no /api/v path appears on the
  marketing host. Iterates the live contract registry plus the
  long-form deploy-TTL builder (which was already correct but had been
  excluded from the contract gate for length). Verified to fail-fast
  on any re-introduction of the bug (CLAUDE.md rule 18).
• Update one collateral test assertion in resource_pause_test.go to
  the dual-host check so AgentActionResourceAlreadyPaused continues
  to satisfy its per-handler URL assertion.

Coverage block (CLAUDE.md rule 17)

Symptom:        agent_action returns "POST https://instanode.dev/api/v1/..."
                -> HTML 404 on the marketing site
Enumeration:    rg -nF 'https://instanode.dev/api/' internal/   -> 11 sites
Sites found:    11
Sites touched:  11
Coverage test:  TestAgentActionContract_APIPathsUseAPIHost
                (registry-iterating, asserts the live contract)
Live verified:  curl host comparison above; post-deploy, every wall
                returning one of these strings will carry the working
                URL (no live curl proves wire content beyond unit
                tests since walls require an authenticated request).

Test plan

• go build ./... clean
• go vet ./... clean
• TestAgentActionContract PASS (includes the relaxed dual-host check)
• TestAgentActionContract_APIPathsUseAPIHost PASS (the new gate)
• TestAgentActionContract_RegistryCoverage PASS
• Sanity-revert one site -> new test FAILS at the right place,
  restored after verification
• All TestPause* / TestResume* / TestResidualPause* PASS (the
  handler tests that exercise the changed AgentActionResourceAlreadyPaused)
• All TestRedeploy* / TestDeployRedeploy* happy-path PASS (the
  no_existing_deployment_to_redeploy code path)
• CI deploy.yml test step (will run after push)
• Post-deploy: curl /healthz shows new SHA, then a synthetic
  hit on a 4xx wall (e.g. anon team tries to remove primary user)
  surfaces the corrected URL

Notes

• Diff: +92 / -14 across 4 files (well under the 200-line cap).
• Pre-existing test failures on origin/master (TestLinkGitHubID,
  TestDeployRedeploy_Goroutine_ComputeDeadline) are unrelated to this
  change and reproduce on a clean checkout of origin/master. They
  surface only in local runs against the shared test-pg; CI's
  per-package isolation handles them. (See memory
  feedback_coverage_measure_per_package_not_dotdotdot.md.)

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com