Services: the client libraries in #834 are the generated client plus a signing helper, not new hand-written packages

#834 plans a .NET and a TypeScript client library for message handling services: verify signatures, reply to a waiting run, write back with `Idempotency-Key`, send heartbeats and use typed messages. Built as described, those are two new hand-written clients. D13 (`DECISIONS.md:464`) already settled how clients are built: a small hand-written base plus generated slices, one per OpenAPI tag, and no generator of our own.

### Why it is too specific

Two libraries shaped around one use, a payroll service replying to a workflow, duplicate the transport, auth, tenant header and error shape the base client already owns, and drift from the API the way D13 describes. A clinic's lab integration or a school's SMS gateway needs the same calls and would get another wrapper.

### The general concept

A service uses the D13 client: the base plus the slices for what it calls (run replies, the services registry, content writes). What is actually new is small: a signature and timestamp verifier with replay protection, and message types generated from a message type's schema. Those ship as a helper beside the base in both languages. The starters and the tutorial in #834 build on that, and #834 should be amended to say so.

### Where it lives

The client packages (base plus a signing helper) and the `barakocms-service` template.

### Compatibility

Nothing is released. This changes the plan in #834 before code exists.

### Done when

- The client library part of #834 is rewritten around the base client, generated slices and a signing helper.
- The starter's handler verifies a message and writes back using only the base, a generated slice and the helper.

Found in the architecture sweep of 15 September 2026.

Start with DECISIONS.md:464 and issue #834, then inspect the client packages and the barakocms-service template mentioned in the issue. Update the plan around the base client, generated OpenAPI slices and a signing helper in both languages; it is done when the starter verifies a message and writes back using those pieces.

Written by the indexing model from the issue text.