feat(unstable-v2): patch upsert _meta by top-level key

[benbrandt]

v2 upserts now apply a concrete top-level _meta as a key-level patch instead of replacing the whole stored object. This is the same three-state rule the update already applies to its own fields, one level down:

• Omitted _meta leaves the stored metadata unchanged; null clears it.
• An object patches by top-level key: omitted keys stay, a key set to null is removed, and any other value replaces that key whole. Nested objects are not merged, and _meta: {} changes nothing.

This adds the v2 Metadata Patches RFD, which covers motivation, replay rules, v1 compatibility, conformance cases, and an FAQ.

Why

Unlike the other patch fields, _meta has several independent writers. Replacing the whole object made each writer responsible for every other writer's keys:

• Agents that send different keys on different reports lost the earlier ones (the hazard docs(unstable-v2): warn that tool-call _meta replaces stored metadata #2355 documented).
• A proxy that added one key to an update without _meta erased the Agent's stored metadata.
• Changing one key meant resending all the others.

Scope

The rule applies to the top-level _meta of:

• tool_call_update, including a permission request's tool_call subject
• terminal_update
• user_message, agent_message, agent_thought
• session_info_update, compaction_update
• the draft-only subagent_update and session_message

Every other _meta field is unchanged, including plan_update and the session/update envelope's params._meta (the place for data about a single notification). v1 is unchanged.

Review notes

• Replay now has to remove stale keys explicitly: set them to null, or send _meta: null and then the new object. The two-update form isn't atomic.
• A key can no longer store a literal null. rawInput/rawOutput already make the same trade-off.
• v1 unstable updates diverge. The v1 unstable session_message, subagent_update, and compaction_update still replace _meta whole. The subagents and compaction RFDs now say so.
• apply_meta_update is new public API in the v2 module. It lets clients that store message, session-info, or compaction state reuse the rule.