fix: send the slug on update so the API can refuse a rename

[Alex (Alexkuva)]

Problem

Customers, deployment zones, entitlements, entitlement groups, licenses and service accounts are never renamed. Their PUT accepts the current slug and refuses any other with a 422, <Operation>.SlugNotRenameable.

The SDK's update payloads for those six dropped Slug. A rename request therefore returned success and left the old slug in place without a word. Found through the CLI on noprod: kaiten entitlements update webhook-2bb271 --slug webhook printed "Entitlement updated" and exited 0, while the same body sent with curl came back 422 UpdateEntitlement.SlugNotRenameable.

Change

• The six update payloads send Slug when it is set (omitempty), so the API decides and its refusal reaches the caller as an *sdk.Error with Code set. The six update bodies in app/openapi.yaml (Customer, DeploymentZone, EntitlementGroup, Entitlement, License, ServiceAccount) all publish slug.
• The current slug is still accepted, so writing back what was read keeps working. An input with no slug still renders no slug key.
• The Slug doc comments, the license payload comment and the README say what the field does on update.
• Components and instances are untouched: their update already sends the slug, and the API acts on it.

Tests

• TestUpdateLetsTheAPIRefuseARename runs the six updates against a responder that applies the API's rule. Another slug must surface the 422 and its code, the current slug must succeed, and a nil slug must render no key. On main, all six "refuses another slug" cases fail.
• TestRequestBodiesMatchTheirSpecBodies now expects slug in the six update bodies.
• task lint: 0 issues. go test -race ./...: green.

Follow-up

Once this is released, the CLI bumps sdk-go. Its --file and --payload updates will then report the refusal too (kaitencloud/cli, separate PR).

🤖 Generated with Claude Code · ✅ Tested and approved by Alex (@Alexkuva), maintainer