fix: Read pagination from the response instead of a client hook

[razor-x]

What

The paginator captured the pagination envelope by appending a response hook to the shared client's event_hooks, making the request, then calling .pop() (SDK audit finding H4). That side-channel had four defects, all reproduced by the audit:

• No try/finally: any failed page request (4xx/5xx, timeout) leaked the hook onto the client permanently — every later response on that Seam instance was force-read and JSON-parsed by a dead paginator's hook.
• .pop() removes the last hook, not the paginator's own: two interleaved paginators cross-deleted each other's hooks. The async client made this the default failure mode — asyncio.gather over two paginators is normal usage.
• A non-dict pagination value silently truncated flatten() to one page with no error.
• The cursor-keyed _pagination_cache grew unbounded and used a "FIRST_PAGE" string sentinel that could collide with a real cursor.

The redesign removes the side-channel entirely:

• Paginated routes now return a PaginatedList — a list subclass carrying the response's pagination envelope as an attribute. Callers of *.list() see no difference (isinstance(x, list), iteration, equality all unchanged). This is a codegen template change gated on hasPagination, so it lands at every paginated route at once, and any future request-level behavior reaches paginated requests for free (the drift-resistance property from the JS fix wave).
• The paginator reads data.pagination directly: no hooks, no cache, no sentinel, nothing shared. A missing or non-object envelope raises SeamHttpInvalidResponseError (from fix: Raise a Seam error for a success response that is malformed #638) instead of silently truncating.
• The paginator's client constructor parameter is retained for signature compatibility but no longer used.

Also bumps @seamapi/fake-seam-connect 2.0.5 → 2.0.6, which fixed /access_codes/list returning no pagination envelope (the same upstream fix the JS wave landed as fake-seam-connect #283) — the new envelope check caught it immediately.

Stacked on #639; diff shrinks as the stack merges.

Testing

New test/paginator_isolation_test.py: two async paginators under asyncio.gather each see their own pagination with zero hooks on the client; a failed page request leaves no hooks; missing/non-object pagination envelopes raise with pinned messages (sync + async); paginated routes still return a plain list carrying the envelope.

Revert check: with the old paginator restored, the tests fail with the audit's exact symptoms — one leaked hook after a failed request (assert 1 == 0 with the lambda visible), interfering concurrent paginators, and DID NOT RAISE on the truncation case.

Full suite: 232 passed; mypy, pylint (10.00), black clean; regeneration drift-free.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y1RzepycXEYA3LStfjt8cY

---

Generated by Claude Code