Compare definitions by meaning, and stop miscounting what was recorded

Two problems found by deploying the previous commits to production.

FIRST: the rewrite guard compared raw Markdown, so it refused a publish over
formatting. The authoring UI re-serialises a definition when somebody saves it
— writing `webSearch: false` where the hand-authored file omitted the key, and
ordering the frontmatter its own way — and the parser reads absent and false
identically (agent.go: `data["webSearch"] == true`). A definition nobody
meaningfully changed stopped a deploy. Refusing a change that is not a change
is still a bug, even though it fails safe.

definition.SameAgent and SameSkill compare the parsed definition instead, and
are deliberately conservative, because the two ways of being wrong are not
equally bad. A false difference blocks a deploy: visible, recoverable. A false
SAMENESS lets a changed agent overwrite an approved version silently, which is
the thing versioning exists to prevent. So:

  - The body is compared verbatim. Agent.Body carries `json:"-"`, so a
    comparison that only marshalled the struct would call a completely
    rewritten system prompt "unchanged". There is a test that fails loudly on
    exactly that, because it is the mistake this design invites.
  - List ORDER stays significant. loader.go resolves Skills in order and that
    order reaches prompt assembly, so two definitions listing the same skills
    differently are still different. A deploy that only reorders still has to
    raise its version. That is a limit, recorded in a test rather than left to
    be discovered: loosening it needs somebody to decide skill order cannot
    matter, which is not a decision to bury in a comparison function.

What it absorbs is exactly what the round trip produces: frontmatter key order,
whitespace, and a defaulted value written out in full.

SECOND: importagents reported "9 agent version(s) recorded" on a run that
recorded nothing. The counter incremented on every successful Snapshot call,
and Snapshot returns nil for the idempotent no-op as well as for a real insert.
The skill counter was already honest; the agent one was not. snapshotAgent now
distinguishes recorded / conflict / already-present, and only the first counts.
Verified locally: 1 on the run that added activity-agent v2, 0 on the re-run,
where it previously said 9. A number that says nine every time is one nobody
checks on the day it matters.

Full suite green against PostgreSQL, only TestLive* skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJvibeSc1JYXjatankqM1g

go-api/internal/service/definitions.go

@@ -571,7 +571,12 @@ func (s *DefinitionsService) refusePublishedRewrite(ctx context.Context, ident a
 		// place to fail the save.
 		return nil
 	}
-	if stored.Markdown == markdown {
+	// Semantic, not textual. The authoring UI re-serialises a definition when
+	// it is saved, so a byte comparison refuses a publish over frontmatter key
+	// order and a defaulted value written out in full — see
+	// definition.SameAgent, which is deliberately conservative about what it
+	// treats as inert.
+	if definition.SameAgent(stored.Markdown, markdown) {
 		return nil // republishing the same version unchanged is a no-op
 	}
 
@@ -708,7 +713,7 @@ func (s *DefinitionsService) snapshotSkill(ctx context.Context, ident authctx.Id
 	}
 	if latest > 0 {
 		stored, err := s.versions.Load(ctx, ident, repo.KindSkill, definitionID, latest)
-		if err == nil && stored != nil && stored.Markdown == markdown {
+		if err == nil && stored != nil && definition.SameSkill(stored.Markdown, markdown) {
 			return nil // unchanged since the last publish
 		}
 	}