fix(vcs): send the field names the API requires for create_link

[escott-]

vcs(action="create_link") has never worked against the API. It posts source_type, source_id, target_type, target_id; the API's create-link request is vcs_object_type, vcs_object_id, cs_object_type, cs_object_id, all required, with both ids as UUIDs. An agent reported "missing field vcs_object_type" (serde reports only the first of the four).

The tool's schema already documents source_* as the VCS object ("repo, pull_request, issue, or commit") and target_* as the ContextStream object ("project, doc, plan, task, todo, decision, or node"), so the handler now sends source_* as vcs_object_* and target_* as cs_object_*. No parameter or schema changes. Both ids are parsed as UUIDs before the request, so a bad id is named in the error.

The API contract was read from the private API's CreateLinkRequest and handler; nothing in it constrains the type strings, so none are enumerated here.

Tests

New vcs_tests.rs, the first tests for this tool. They drive create_link through VcsTool against a local server that records the request: the exact path and body the API receives, trimming, and an error naming each missing or non-UUID field. They fail on the previous handler (the body received was {source_id, source_type, target_id, target_type}) and pass now.

Verification

On ovh-desktop, against main b5936a3 plus this change:

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets: 2958 passed, 0 failed (2955 before, plus the 3 new)
• account_connection_smoke.py: 9 tests
• cargo audit --deny warnings and cargo deny --locked check: clean

On a clean copy of the tracked files: public_boundary.py, release_contract.py resolve-version, the release-contract, boundary, DCO, workflow, grounding and adoption script tests, and npm test (6/6).

Not verified: a real create_link against the live API with credentials (it writes a row; the request body is verified against the API's own request struct instead). The other vcs actions were not audited; this one had no tests, so a similar mismatch elsewhere would not have been caught either.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}