fix: Send the action attempt poll id as a query

[razor-x]

Fixes finding M1 from the cross-SDK audit.

Rebased onto beta at a2cd8ce (4.0.0-beta.13), so the conflict is gone. Re-checked against beta after #478 changed HTTP verbs: the generated /action_attempts/get route is still GET with a query, so the mismatch this fixes is still real.

The problem

ResolveActionAttempt::get_action_attempt polls with the id in a JSON body on a GET:

$client->request("GET", "/action_attempts/get", [
    "json" => (object) ["action_attempt_id" => $action_attempt_id],
]);

The generated route for the same endpoint sends a query (src/Routes/ActionAttemptsClient.php):

$this->client->request("GET", "/action_attempts/get", [
    "query" => $request_payload,
]);

Two consequences:

• A GET body is not carried reliably. Any proxy, CDN, or load balancer that strips one breaks every wait loop — and it breaks it after the door has already been commanded, so the caller sees a failure for a write that succeeded.
• _strict=true was never applied to the poll. SerializingClient only adds it to a query, so the poll skipped the schema-aware parsing every other read gets.

The fake server reads GET bodies happily, which is why no existing test caught it.

The fix

Send a query, matching the generated route. The poll now goes out as GET /action_attempts/get?action_attempt_id=…&_strict=true with an empty body.

Tests

testPollSendsTheIdAsAQueryNotABody asserts the poll's method, path, query string, and empty body via RecordingClient — the fake can't show this. Against current beta it fails with the query string empty:

-'action_attempt_id=aa_1&_strict=true'
+''

Full suite: 229 tests green, psalm clean, npm run lint clean. The deprecations in the run are the resource-constructor issue from #473, not yet on beta.

Note on scope

The audit's preferred form is polling through the generated ActionAttemptsClient with wait_for_action_attempt: false, as the JS SDK does. That requires threading the route client through codegen and touches every generated route; this PR fixes the wire shape only. Happy to follow up with the injection version if you'd rather have it.

---

Generated by Claude Code