feat: version the direct-setup templates and send provenance

[hieptl]

• A human has tested these changes.

---

Why

OpenHands/automation#76 (architecture-aligned scope) keeps template definitions in this repository and has the automation service store only opaque provenance: a template identifier, a template version, and the non-secret submitted configuration. The service now accepts that provenance on its preset create endpoints and uses it for idempotent enablement and one-time first-run reporting — but no catalog entry carries a template version yet, and the contract fixtures don't record the new request field. Without a per-entry version, hosts have nothing to send and upgrade identity cannot exist.

Summary

• automations/catalog.schema.json and automations/index.d.ts gain an optional top-level version (strict ^\d+\.\d+\.\d+$ semver); github-pr-reviewer and github-repo-monitor are stamped 1.0.0. Bump an entry's version when its prompt, form, or filter changes meaningfully.
• tests/test_automation_setup.py::_render_payload — the authoritative form→payload reference — appends template: {id, version, config: form_values} for versioned entries, and the schema-rejection test now pins that a non-semver version is refused.
• Both direct-mode fixture bundles carry the template object in every replayed create/preflight body, and their happy-path 201 responses record the service's new preset_metadata.

Issue Number

Resolves OpenHands/automation#76

How to Test

uv sync --group test
uv run pytest tests/ -q          # 512 passed — includes the fixture replay
                                 # tests that pin derived bodies byte-for-byte
npm run build:automations        # regenerates catalog-index.js with no diff

Cross-repo contract check (run from a checkout of OpenHands/automation containing the provenance change): validate each updated fixture's create.request.body against the live CreatePromptAutomationRequest and each 201 body against AutomationResponse — all pass.

Video/Screenshots

N/A.

Notes

• The assisted entry (incident-retrospective-drafter) intentionally gets no version: it never posts a create body, so it has no provenance to send.
• Unversioned entries are untouched — hosts send their payloads unchanged, so this release is backward compatible with deployed automation services (template is optional server-side).
• Rollout: after this publishes, Agent Canvas bumps its @openhands/extensions pin; that bump must land only after the automation service deploys the provenance change, because its create models are extra="forbid".

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.

[openhands-release-bot]

🚀 Released in v0.18.0.