0.6 prerelease checklist: stabilize guest-agent API and SDKs

[h4x3rotab]

Objective

Ship dstack 0.6 with a stable, versioned guest-agent API and consistent Go, JavaScript/TypeScript, Python, and Rust SDKs. Existing 0.5.x clients must continue to work against a 0.6 agent.

Compatibility

• Keep the unversioned API fully compatible with 0.5.x, verified with v0.5.10 generated clients and SDKs.
• Keep GetQuote unchanged: the v0.5 response fields and semantics remain the complete contract. Cross-platform attestation is exposed through Attest, not GetQuote.
• Keep GetKey wire- and behavior-compatible. Publish a normative specification for path, purpose, supported algorithms, defaults, output encoding, and signature-chain verification.
• Make EmitEvent return 404 with informative error message (deprecated method)
• Unknown algorithms must be rejected.

Attestation

• Make Attest the single API for platform and GPU attestation

SDKs

• Release all changed SDKs as 0.6.0 and apply semantic versioning consistently.
• Expose the same TlsKeyOptions fields and defaults in every SDK. usage_server_auth defaults to true; remove the unused path option.
• Represent the TLS private key as PEM and provide an explicit toPkcs8Der() conversion. Remove ambiguous byte-conversion APIs.
• Represent protobuf byte fields as bytes in Rust, not hex strings.
• Make all SDKs report non-2xx responses consistently, including the server error and HTTP status.
• Regenerate and review the protobuf, HTTP, and SDK reference documentation.

Versioned API (future)

• Introduce the long-term API under a versioned URL/service namespace such as /prpc/v1/... and protobuf package dstack.guest.v1. API selection must not depend on request headers.
• Use *Request and *Response consistently for new messages. Keep the method name Attest.
• Give opaque JSON fields explicit *_json names in v1, or use typed messages where the schema is stable.

Signing (future)

• Provide Sign with an explicit key specification containing path, purpose, and algorithm.
• Add GetSigningKey to return the corresponding public key and certification chain without signing a message.
• Provide signature verification as SDK functionality rather than an agent RPC.
• Specify the exact Ed25519 and secp256k1 message and prehashed modes.