feat: Add actor me, the actor a key represents

[a1594834522-coder]

Harness setup flows had to guess which actor was the caller's, using
"prefer the HUMAN actor" over actor list. That is wrong whenever an
account has several humans, which is the normal case for a shared
workspace. The backend now answers directly.

memorylake actor me
memorylake actor me | jq -r .id

The path is not what the task spec assumed

The spec flagged this as unverified and asked for confirmation first.
It guessed GET /api/v3/actors/me. It is actually:

GET /api/v3/defaults/my-actor

Confirmed against the swagger definition and called live against
production, where it is already deployed. The captured response is the
fixture the decoding test runs on.

A 200 does not mean the actor is bound to a workspace

Documented on the endpoint, and true for the account this was developed
against: actor me returns actor-fd25f63e…, which does not appear
in actor list --workspace ws-2464…. The actor comes with the account;
joining a workspace is a separate act.

This matters for the harness plan of preselecting the default in a
workspace-actor picker -- the default may not be in that list at all, so
the flow needs a branch for "not bound here" rather than assuming it can
highlight a row. Called out in the docs, the rustdoc, and --help.

Failure behaviour

NOT_FOUND is reworded rather than passed through. Every key has an
actor -- confirmed with the requester, and it removes the ambiguity the
spec worried about in §2.2 -- so a 404 can only mean the route is absent,
and a bare "NOT_FOUND" would read as "you have no actor", the opposite of
the truth. The server's own message is kept for diagnosis and the
machine-readable code survives, so callers can still branch on it.
Everything else (auth, transport) takes the existing paths untouched.

Named me, not default

default is already a concrete identifier here: it is the name of a
profile (DEFAULT_PROFILE, printed by auth status), so
memorylake --profile work actor default reads two ways. Worse,
actor default would sit beside actor get default, which is a legal
command with a different meaning -- custom_id is caller-defined, so an
actor with that id can exist. And in this CLI default denotes something
you chose and can change; this is neither. me also matches the server's
own noun (getMyActor, my-actor).

Also

Actor gains created_by, which the API sends and the struct dropped.
The CLI prints the record it decoded, so a field it does not know about
never reaches the user -- the same silent-drop that hid tags and
status until recently.

Verification

cargo fmt --all -- --check and cargo clippy --workspace --all-targets -- -D warnings are clean. cargo test --workspace is clean except for
live tests failing at the transport layer from this machine
(client error (Connect), before any HTTP status): two full runs failed
10 then 1 test, a different set each time, never an assertion, and each
one passes when run alone. CI is the arbiter -- its network reaches the
API in a fraction of the time.

🤖 Generated with Claude Code