chore(agent-device): require agent-device 0.21.28 and take its proxy from npm

[V3RON]

agent-device 0.21.28 is the first release with all eight simlock PRs (0.21.27 has only callstack/agent-device#3478). simlock now takes @agent-device/proxy 0.21.28 from npm, deletes vendor/, and requires agent-device 0.21.28 or later.

merged in v0.21.28: #3476 #3477 #3478 #3479 #3480 #3485 #3487 #3594
merged in v0.21.27: #3478
(git merge-base --is-ancestor <merge commit> <tag>)

• Version check: the minimum moves from 0.21.25 to 0.21.28. A prerelease of it is refused: 0.21.28-nightly.20261013.49 predates most of the PRs.
• Two RPC methods refused: the released proxy refuses everything except command and lease.* from an authenticated tenant. The front now refuses install_from_source and release_materialized_paths itself. The agent-device CLI sends installs as command, so the CLI is unaffected.
• Slow lane: SIMLOCK_E2E_AGENT_DEVICE must point at an install of the pinned version (npm i -g agent-device@0.21.28 or a checkout at v0.21.28), no longer at a commit.
• pnpm: 0.21.28 is exempt from the minimum release age; it was published today.

Slow lane not run.

Review

Spec review: skipped. Code review: 1 blocking, 1 fixed, 0 notes. Claims review: 0 blocking, 0 fixed, 0 notes.

Rounds: 1. Tokens: n/a.

• Fixed: code: isVersionAtLeast had an untested || needed.prerelease branch no caller reaches; dropped.

Written by an agent.