[SaladDay]

Summary

The integration shards skip every official-client test because they set no OAC_TEST_OFFICIAL_SDK_PYTHON. The api job ran only an explicit list of 11 of the 36 such tests, so 25 never ran in CI. Nine of those need a real model and native daemon and stay manual. Of the remaining 16, one had rotted: TestTemplateNullSelectionOfficialClientPostgres still expected 400 for network restrictions that the network policy now accepts.

• New composite action .github/actions/official-sdk installs the client pinned by contracts/agents-api/upstream.json. The api job and the integration shards both use it.
• The integration shards set OAC_TEST_OFFICIAL_SDK_PYTHON, so every official-client test in the package runs there. The explicit list in api-acceptance.yml is deleted.
• ci_plan.py routes the new action to backend, api and lint.
• The template test now checks today's rule: a Session network may only narrow the Template's. null inherits the Template's disabled; enabled is still rejected as a widening.
• docs/maintainers.md (en/zh): the backend row says the shards run with the pinned client.

Verification

• Locally with SDK 3.45.0 and Postgres, all 16 non-native tests that were missing from CI pass, including the fixed template test.
• make check-ci and check-translations pass.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}