Align template-reference null selection semantics

[SaladDay]

Template-reference Session creation rejected explicit null network and capability lists even though the pinned official behavior inherits them. Null now inherits network, Skills, Plugins and capability directories through the shared selection rules. Non-null lists still replace, and network overrides cannot widen template authority.

Tenant-scoped resolution, encrypted frozen snapshots and retry intent remain unchanged. Template resource reset/clear rules remain distinct. Annotations, generated OpenAPI and coverage documentation describe the qualified behavior and remaining gaps.

Validation:

• Owned official SDK 3.13.0/raw HTTP probes: 82 requests, one real official Turn, all owned resources publicly deleted.
• Real PostgreSQL plus strict SDK/raw HTTP: 11 successful selections and 8 rejections, including isolation, encryption, frozen contents and retries after source/template deletion.
• Codex/Docker with real Kimi and MiniMax models: native inheritance, clearing, replacement and frozen contents after Core restart, without repeated setup. Provider and fixture failures remain recorded in contracts/agents-api/template-null-selection.md.
• Fresh independent GPT-6 Astra high review covered the entire diff and found no in-scope issues.
• Complete server/native make check targets and fresh make check-web passed; OpenAPI regeneration and sqlc byte checks passed. Optional large-file/packaged native profiles were not enabled.

No full protocol compatibility or new all-harness/Provider qualification is claimed. Official derived directory projection, broader hostname forms and exact errors remain separate gaps.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}