Move to the released SDK and say ValidationErrors

[bgrant0607]

The ConfigHub API renamed Unit.ApplyGates to ValidationErrors and
ApplyWarnings to ValidationWarnings. The examples now use the new names.

The SDK bump is a prerequisite, not a tidy-up

The rename needs a released SDK that has the field, and the only one that does
is v0.4.12 — v0.4.11 predates it. v0.4.12 also carries the Ref/Resolve
rework, so there is no version that gives one without the other. That migration
is most of this diff:

ResolveSpace(ctx, c, slug)    ->  ResolveSpace(ctx, c, ParseRef(slug), ResolveOpts{})
ResolveFilter(ctx, c, id, s)  ->  ResolveFilter(ctx, c, ParseRef(s), ResolveOpts{Space: id})

and those helpers now return Extended* envelopes, so sp.SpaceID became
sp.Space.SpaceID and a returned *Invocation became inv.Invocation.

The envelope fixes were applied at the lines the compiler named, not by
substitution: some sp in the same files come from EnsureSpace, which still
returns a plain *Space, and a blanket rewrite broke exactly that in
managerkit/guardrails/pack.go.

On the TypeScript side, @confighub/api and @confighub/rtk-query go to
^0.4.6, the first release carrying the field. Several apps had node_modules
as old as 0.1.2 — below their own declared ^0.4.4 floor — so seven
lockfiles move with them.

triggers-and-applygates is left alone throughout: it is the name of a skill,
not a field.

Verified, not assumed

A version bump is not proof anything compiles, and four of the apps
(sec-scanner, rbac-manager, promoter, cost-estimator) have no test
files at all, so npm test exits 0 there without checking anything. Those
were built instead, which is what actually typechecks the rename.

	result
10 Go modules	go build and go vet clean
fleet-ql	298 tests pass
configboard	166 tests pass
webkit	29 tests pass
sec-scanner, rbac-manager, promoter, cost-estimator, configboard	build clean

Reviewing this

The migration and the rename are in one commit because they are genuinely
coupled — the rename does not compile without the bump. If it helps, the
mechanical parts are the go.mod/package.json/lockfile changes and the
Resolve* call sites; everything else is the terminology.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge1C6Wm1qR3WUCxEZKPboc