Replace PaperSecret Age suite wire bridge with generated SDK #147

Context

cone #146 added post-quantum PaperSecret support and merged as f0d48158396d7b7f069f1e21465f8b903ac4ad59.

c1 #21494 merged the public API fields for explicit Age suite negotiation:

• create request requiredAgeSuite
• create response ageSuite
• AGE_SUITE_MLKEM768X25519

At #146 merge time, the latest published conductorone-sdk-go and its existing regeneration PR predated c1 #21494. Cone therefore uses a narrow temporary authenticated JSON bridge in pkg/client/secret.go for only:

• POST /api/v1/secrets/internal
• POST /api/v1/secrets/external

Trigger

A post-c1-#21494 conductorone-sdk-go revision is published that exposes requiredAgeSuite on both create request models and ageSuite on the create response model.

Change

• Upgrade github.com/conductorone/conductorone-sdk-go to that generated revision.
• Delete the temporary raw create bridge and its JSON/map/URL plumbing.
• Restore c.sdk.PaperSecret.CreateInternal and CreateExternal as the only create paths.
• Set generated RequiredAgeSuite to the generated MLKEM768X25519 enum.
• Require the generated response AgeSuite to equal MLKEM768X25519 before encryption.
• Preserve hybrid recipient parsing, hybrid text/file encryption, hybrid readers, bare storage HTTP clients, and fail-closed downgrade behavior.
• Remove only bridge-specific tests; keep behavior tests proving exact request suite, response mismatch rejection, authenticated transport, hybrid stanza, and text/file round trips.

Authenticated GetContent remains SDK-backed and continues negotiating through the hybrid reader recipient; do not invent suite fields that are absent from that API.

Acceptance

• No direct raw HTTP calls remain for PaperSecret create.
• Generated SDK types carry the exact suite request and response.
• go test ./pkg/client ./cmd/cone passes.
• golangci-lint run ./pkg/client/... ./cmd/cone/... passes.
• make build passes.
• Vendor and module metadata are regenerated according to cone conventions.