0.6.1: parse production error bodies, sync OpenAPI 3.30.0, fail on malformed WS frames

[UTXOnly]

Follow-up to the 0.6.0 accuracy review. Patch release: every change is an addition or a bug fix, and gorelease -base=v0.6.0 reports only compatible changes.

Merging this tags and publishes v0.6.1. The release job runs on push to main.

Fixes

• APIError.Code/Message empty against production: error body is nested under "error" #7 — APIError.Code / Message were empty for every production error. types.ErrorResponse follows the spec's flat {"code","message","details"}, but production returns {"error":{"code":...,"message":...}} for most errors and {"msg":"..."} for parameter-binding 400s, so Error() printed only api error 404. newAPIError now decodes all three shapes (flat wins when both are present). Tests use the bodies observed from the live API.
• WebSocket: unparseable frames are skipped silently instead of failing the connection #10 — WebSocket text frames that were not valid JSON were skipped silently. The read loop now fails the connection with an error wrapping the new ErrWSMalformedFrame, closes Messages(), and returns that error from pending commands — same path as ErrWSSlowConsumer. Frames received before the bad one are still delivered.

Additions

• Sync vendored specs to OpenAPI 3.30.0 (Series.categories, resting_margin_reservation) #8 — Vendored specs synced to OpenAPI 3.30.0 (AsyncAPI stays 2.0.0; its diff is CF Benchmarks index-ID documentation). New fields: Series.Categories (the full discovery list; Category is the primary and the category filter matches any entry) and GetTargetBalanceAllocationResponse.RestingMarginReservation.
• Expose exchange_index / subaccount filters on Orders.List, GetFills, GetPositions, ListHistoricalPositions #9 — Missing optional filters: ExchangeIndex on GetOrdersOpts / GetFillsOpts / GetPositionsOpts, Subaccount on GetHistoricalPositionsOpts. Tests cover the parameter being sent and being omitted when nil.
• Add tests for Unsubscribe and ListSubscriptions success paths #12 — Tests for the Unsubscribe (one reply per sid) and ListSubscriptions success paths, from the AsyncAPI example payloads.

Docs

• README corrections from the review: the CreateV2 example was missing the required self_trade_prevention_type; the not-implemented list omitted several paths; retry section states the Retry-After cap and the 409-on-replay behavior for client_order_id; WebSocket section covers private channels, subscription-scoped error frames (terminal codes 10/25), the AsyncAPI host, and server pings.
• CHANGELOG 0.6.0 "never dropped silently" heading narrowed to what that change guaranteed.
• cmd/example/README.md no longer claims LIVE=1 forces production.
• New AGENTS.md: tool-neutral contributor guide — layout, spec-sync workflow, conventions, the mandatory-test matrix, CI version-job rules, and the spec-vs-production differences above.

Not in this PR

#11 (remove dead legacy V1 order types) is API-incompatible and needs a 0.7.0 with a ### Breaking section; left open.

Verification

gofmt clean · go mod tidy no-op · go vet · staticcheck clean · go test -race -count=1 -shuffle=on ./... passes · version.go / CHANGELOG / README pin agree on 0.6.1 · gorelease -base=v0.6.0 -version=v0.6.1: "v0.6.1 is a valid semantic version for this release" (only compatible additions).

Fixes #7
Fixes #8
Fixes #9
Fixes #10
Fixes #12

🤖 Generated with Claude Code