fix(tools): correct diagram, DataHub export, and AWS contracts

[dmitrijs-pavlovs-dev]

Diagram selectors were stripped by the API, component loading did not honor its defaults, and generated DataHub export discarded the cursor response header. This change sends the correct diagram DTO, verifies requested IDs through scoped discovery, limits component reads to five distinct layers, and returns an export-only {data, pageToken} envelope. skip_empty filters layers while retaining diagrams.

AWS supported-feature lookup validates 12-digit account IDs. Dataset updates expose displayName/logoName, rendering lookup is marked as a mutation with the directory-required confirmation annotation, and descriptions reflect API contracts. Cost trends use percentage units; the upstream cost-total calculation is unchanged. Other generated response shapes are unchanged.

Actual built stdio MCP tools were compared against https://api-dev.doit.com on 2026-10-06. Isolated snapshots used baseline 15b6b1c, feature d1847b7, and pre-review 456507a for review regressions. No fixture results are counted as live evidence.

Real dev case	Before → feature	Conclusion
Existing diagram/layer selectors	All 119 diagrams, no selected layer map → selected diagram/layer only	Defect reproduced and fixed
Component loading	No component map → projected group matching API; selected diagram resolves both layers	Defect reproduced and fixed
CSV/JSONL export	API cursor lost from MCP → exact body/cursor preserved; second page advances; empty final page has null cursor	Defect reproduced and fixed
Six component layers	Pre-review loaded six maps → MCP batching error before component loading	Review fix verified
Foreign/mixed selectors	Pre-review API 403 → feature scoped-discovery rejection without targeted reads	Defense verified; metadata leakage did not reproduce
Dataset new fields / invalid logo / long display name	Baseline rejects new-field-only input locally → feature reaches API 404/400 and returns MCP errors	Failure paths only; successful updates unverified
Azure-shaped supported-feature ID	API 404 → local AWS validation error, zero HTTP calls	Input validation verified; successful AWS lookup unverified
Invalid cursor/window/auth; skip_empty; cost/search/activity reads	Errors and successful read behavior preserved	Compatibility coverage, not additional fixed defects

Cleanup: no remote resource was created or successfully updated; no remaining resource IDs. Negative PATCH targets were independently 404 before and after. A nonexistent-name DELETE was 404, but current deletion timeout/202-completion limitations prevented establishing reliable cleanup for a newly created dataset, so no dataset/event was created. A synthetic unmatched find lookup reached the API (there is no server-side dry-run gate); independent search found zero matches, and the backend exits before filter/image creation for that case. No matched rendering, ingestion, workflow execution, deployment, publication, or PR merge was performed. Temporary validation directories were removed.

Remaining gaps: positive dataset set/clear, event ingestion/atomicity/constraints, successful AWS/standalone lookup and bucket semantics, non-null trend units, rendering artifacts, relationship truncation, and hosted OAuth. Built metadata, fixture tests, and empty/null samples do not prove those behaviors.

Main advanced during validation, so the branch was synchronized with e5845c4 to resolve a test expectation conflict and integrate upstream API error handling. Both latest main and the synchronized feature were built in fresh isolated directories. Actual dev MCP calls reproduced the diagram-selector and CSV/JSONL cursor defects again and verified the fixes, component guard/defaults, selector errors, empty exports, API 400/401/404 errors, and local AWS ID rejection. Rendering lookup retains mutation retry advice; simulated 503 coverage is a repository test, not live rendering evidence. No dependency pins changed relative to main.

Repository checks are separate: Node 20.20.2 and 22.23.2 passed 1,213 unit tests, 289 integration tests, and builds, retaining all 106 schema-parity cases. yarn check:dev, yarn check:ci, and diff checks passed. CI was green on the previously validated 692e4fb head. All temporary validation directories were independently confirmed removed.

Current branch integrates main 0d2f856 in 1142b64, resolving the generated override conflict by retaining both the DataHub export response cursor and the explicit read-only POST component lookup. The combined branch passed 1,238 unit tests, 293 integration tests, yarn check:dev, build, and whitespace checks. All four required CI checks pass on 1142b64. Existing real dev evidence above remains tied to its recorded revisions; this merge resolution did not make new live API calls.

Directory annotation follow-up in fa629af: find_cloud_diagrams retains readOnlyHint: false and now sets destructiveHint: true, because its persisted sheet filter/render request modifies data. This follows Claude directory requirements. Removed the mutation exception from the server listing test; all tools must expose the applicable true hint. Type/lint checks, build, and 245 focused diagram/server/schema-parity tests pass. This metadata correction adds no new live API claim.