Go: audit raw-Client doRequest status mapping beyond 400/422

Follow-up to #527 / #549, which gave `Client.Get/Post/Put/Delete`'s doRequest its missing 400/422 → `validation` mapping (SPEC §6 status table) and unified its body parsing on `parseErrorBody`. Remaining unmapped 4xx statuses (e.g. 409, 410, 418) still fall to the `default:` branch as `api_error` with `retryable: false` — consistent with §6 step 12, but the branch predates the status-mapping algorithm and has never been audited against it end to end (e.g. 404 vs `ErrNotFound("Resource", url)` message shape, 403 scope-hint behavior vs `checkResponse`'s). Low priority; behavior-only audit, no known bug.

Start at the raw Client doRequest status mapping and compare it end to end with SPEC §6, especially the default branch, 404 ErrNotFound message shape, and 403 scope-hint behavior. Use checkResponse as the comparison point; done means the audit identifies and resolves any discrepancies for the remaining 4xx statuses.

Written by the indexing model from the issue text.