Held: do not merge before blindpay-v2 #1799 deploys

This is wave 2 of the receivers-to-customers cutover. It targets the API shape that goes
live once #1799 reaches production, not what's deployed today. Merging this before
that deploy would break every consumer on the current API. The orchestrator merges it
after a production probe confirms the cutover; the hold-until-1799-deploy label marks
that.

What breaks

Field renames (requests and responses)

The last row wasn't spelled out in the sunset changelog text but is real: the target spec
(.api-sync/spec-snapshot.json) has zero receiver_id properties left anywhere, only
customer_id. Verified directly against the snapshot rather than assumed.

Where wave 1 left a transitional dual key (ListPayoutsInput.receiver_id +
.customer_id, ListPayinsInput same, Owner.receiver_id + .customer_id), the
receiver_id leg is dropped. Owner.customer_id stays NotRequired -- the target spec's
owners[] item schema has no required array at all, so nothing on it can be marked
required.

Removed

• The deprecated receivers resource/module and its client.py deprecation shim.
• The api_keys resource (product decision: API Keys is intentionally absent from the
  public reference).
• receiver.new / receiver.update / receiver.delete from the webhook event enum --
  they stop firing at cutover. They were marked deprecated in wave 1.
• The WebhookEvent additive-release shim from types.py/__init__.py, exactly as
  planned when wave 1 added it ("removal belongs in the next major, alongside dropping
  the receiver.* members").

Unchanged by design (verified against the target spec, not assumed)

• receiver_amount (singular) everywhere -- it's the receiving-side amount on quotes,
  payins, payouts and transfers.
• currency_type still accepts "sender" | "receiver".
• Stored re_-prefixed ID values in tests are untouched; only the receiver_id key
  name changed to customer_id.
• The otc_only_supported_for_sender_without_cover_fees_and_receiver_with_cover_fees slug
  isn't modeled by this SDK at all (no error-message registry here), so there was nothing
  to preserve or break.

The contract check

Added .api-sync/check_contract.py, a dependency-free script (stdlib only, one command:
python3 .api-sync/check_contract.py) that:

• Direction A (hard failure): parses every TypedDict in src/blindpay via ast and
  fails if any declared field name doesn't exist as a property name anywhere in the
  committed spec snapshot (.api-sync/spec-snapshot.json), unless the (ClassName, field)
  pair is in .api-sync/allowlist.json.
• Direction B, webhook events (hard failure): every event in the spec's webhook-event
  enum must be present in the SDK's WebhookEvents literal.
• Direction B, fields (warning only): spec properties the SDK doesn't model are
  counted but don't fail the build.

allowlist.json is seeded only with divergences that already exist on main and are
unrelated to this rename (stale bank_accounts.get() field names, dead/unused input
types, the from-keyword remap on FX rate inputs, tracking_partner_fee / billing_fee
fields the spec never had, undocumented partner_fees CRUD, and a case-only
usdb/usdc/usdt vs USDB/USDC/USDT mismatch). Each entry has a reason and an
owner. Nothing wave 2 was supposed to fix is in there.

Wired into main.yaml as a new contract-check job alongside lint/typecheck/tests.

Versioning

Python bump is feat! / BREAKING CHANGE -> release-please will produce 3.0.0 on
merge (no version files hand-edited; uv.lock's recorded package version was updated by
uv sync, not by hand).

Test plan

• uv run ruff format --check / uv run ruff check .
• uv run pyright / uv run mypy .
• uv run pytest --tb=short -q -- 145 passed
• python3 .api-sync/check_contract.py -- passes; reverting any one rename locally
  makes it fail (verified for both the field-rename direction and the webhook-enum
  direction)

https://claude.ai/code/session_01F1stiNzuNtJXoXtiW9ZCbs