fix: Send the action attempt poll id as a query

[razor-x]

What

The action-attempt wait loop polled /action_attempts/get with a raw POST and a JSON body, while the generated action_attempts.get route uses GET with query params (SDK audit finding M1; same fix as PHP #467). The poll now sends client.get("/action_attempts/get", params={"action_attempt_id": ...}) in both the sync and async variants, which routes through the same strict URL-search-params serializer as the generated method.

Three concrete behavior fixes fall out of matching the generated route's wire shape:

• _strict=true is now sent on every poll (it was silently absent before).
• Polls are covered by the retry policy: GET is in the retry allowlist while POST is not, so a single transient 429/5xx mid-wait no longer aborts the whole wait after the door was already commanded.
• Any proxy/CDN/ALB that strips GET bodies can no longer see a divergent request shape between the poll and the documented route.

Depends on #635 (contains its commit; this PR's own diff shrinks to the get_action_attempt change and its tests once #635 merges).

Testing

• New wire-shape test via the recording server: the poll request is a GET to /action_attempts/get with the id and _strict=true in the query and no request body.
• New retry test: a 503 on a mid-wait poll is retried and the wait still resolves (request count asserted).
• Revert check: with the source reverted, the wire test fails with 'POST' == 'GET' and the retry test fails with the wait aborting on SeamHttpApiError — the audit's exact symptoms.
• Full suite: 193 passed; mypy, pylint (10.00), black clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y1RzepycXEYA3LStfjt8cY

---

Generated by Claude Code