Add reply draft creation and saved draft update/deletion operations

[jr-lillard]

Summary

• Model browser-compatible CreateReplyDraft, UpdateDraft, and DeleteDraft operations in Smithy and regenerate the Go SDK
• Preserve complete composer state when editing a saved draft, mark CSRF/content fields sensitive, submit the canonical single-attempt form PATCH, and retain 2xx/302/303 response details without following redirects
• Accept the live /messages/{id}[/edit] and legacy /entries/drafts/{id}[/edit] Location families while rejecting unrelated numeric routes and unexpected suffixes
• Expose SDK-backed create/update/delete draft services with unit and conformance coverage
• Harden the explicit route-coverage scope so missing, duplicate, empty, or invalid operations fail closed

Relationship to #31

This branch includes the exact patch from #31 as its first isolated commit because reply-draft handling depends on the corrected comma-separated addressed fields. That commit preserves authorship by @cpinto and is included only as a prerequisite; #31 should still be reviewed and merged independently. If #31 lands first, this branch can be rebased and the duplicate commit dropped.

Test plan

• Rebased onto current main
• make check
• Smithy/OpenAPI/generated-code freshness checks pass
• Go vet, lint, and unit tests pass
• 84/84 conformance tests pass
• Live create/edit/verify/delete smoke completed through hey-cli without sending; the temporary draft was deleted

[github-actions]

Spec Change Impact

Model output did not match expected format. Raw output truncated below.

```markdown
## Spec Change Impact

### Summary of Changes:
- **Operations Added:**
  - `CreateReplyDraft`:
    - Endpoint: `POST /entries/{entryId}/replies`
    - Description: Added support for creating reply drafts. Specifies form-urlencoded payload with sensitive fields. Includes support for various recipient address types (directly, copied, blind-copied) and a `Location` response header for the saved draft.
  - `DeleteDraft`:
    - Endpoint: `POST with _method=DELETE /messages/{messageId}`
    - Description: Added support for deleting editable message drafts via form-based method override with a `status` field.

- **Types Added:**
  - `CreateReplyDraftRequestContent`: Wire format for creating reply drafts (includes fields like `acting_sender_id`, `entry[status]`, `message[content]`, etc.).
  - `DeleteDraftRequestContent`: Wire format for deleting drafts (`_method`, `

[Copilot]

Pull request overview

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

This PR models HEY’s browser-compatible reply-draft create/delete flows in Smithy/OpenAPI and regenerates the Go SDK so drafts can be created/discarded via form-encoded transport while preserving redirect Location headers and keeping suffixless draft routes distinct from .json send routes.

Changes:

• Add Smithy/OpenAPI support for CreateReplyDraft (form-encoded) and DeleteDraft (POST + Rails _method=delete override) and regenerate Go client types.
• Update Go routing to keep .json and suffixless routes distinct while providing .json alias matching and improved literal-vs-parameter resolution.
• Introduce scoped, fail-closed route coverage generation/verification and add unit + conformance tests for draft create/delete semantics (form encoding, CSRF handling, redirect preservation).

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
spec/route-coverage.json	Adds coverage entries for reply-draft creation and draft deletion routes.
spec/route-coverage-scope.json	Introduces an explicit allowlist + overrides for route coverage generation.
spec/hey.smithy	Models CreateReplyDraft and DeleteDraft operations + supporting shapes/traits usage.
spec/hey-traits.smithy	Adds form-url-encoded + form-method-override Smithy traits for downstream OpenAPI tooling.
spec/excluded-routes.json	Removes the /messages/{id} DELETE exclusion now that it’s modeled for draft deletion.
scripts/generate-url-routes	Preserves .json in generated patterns so .json vs suffixless routes remain distinguishable.
scripts/generate-route-coverage	Generates route coverage from OpenAPI with scoped allowlist, overrides, and strict validation.
scripts/enhance-openapi-go-types.sh	Converts scoped form operations to application/x-www-form-urlencoded and propagates sensitivity markers.
scripts/check-service-drift.sh	Improves normalization so drift checks handle WithFormdataBody* generated variants.
openapi.json	Adds the two operations, form requestBodies, and related schemas/metadata extensions.
Makefile	Adds route-coverage and route-coverage-check; wires freshness check into check-mvp.
go/templates/imports.tmpl	Adds sort import needed for new form-normalization helper.
go/templates/client.tmpl	Adds redirect-capturing doer for form requests + Rails array form-key normalization during form marshaling.
go/pkg/hey/url.go	Updates router matching to consider .json vs suffixless routes and prefer literal routes over param routes, with alias support.
go/pkg/hey/url-routes.json	Regenerates the embedded route table preserving .json patterns and adding new operations.
go/pkg/hey/url_test.go	Adds routing tests ensuring .json send routes remain distinct and aliases resolve correctly.
go/pkg/hey/services_test.go	Updates addressed-field expectations and adds unit tests for create/delete draft services + Location parsing.
go/pkg/hey/messages.go	Fixes addressed fields to be comma-separated strings in JSON payloads.
go/pkg/hey/entries.go	Routes CreateReply through generated transport; adds CreateReplyDraft and DeleteDraft service methods.
go/pkg/hey/client.go	Wraps generated client HTTP transport to avoid following redirects for form requests (preserving Location).
go/pkg/generated/client.gen.go	Regenerates Go client with new operations, form bodies, metadata, and helper logic.
conformance/tests/reply-drafts.json	Adds conformance coverage for reply draft creation (form encoding + headers + Location).
conformance/tests/draft-deletion.json	Adds conformance coverage for draft deletion (method override + CSRF header + redirect preservation).
conformance/runner/go/main.go	Records request bodies and adds assertions for request headers/forms and response headers; wires new operations into executor.
behavior-model.json	Adds behavior metadata entries for CreateReplyDraft and DeleteDraft.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

All reported issues were addressed across 25 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated no new comments.

[cubic-dev-ai]

All reported issues were addressed across 8 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 26 changed files in this pull request and generated 1 comment.

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[Copilot]

Pull request overview

Copilot reviewed 24 out of 26 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 26 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 26 changed files in this pull request and generated no new comments.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[jr-lillard]

@basecamp/cli @jeremy — this is ready for maintainer review at 2d13b77. It is rebased onto current main and make check passes, including all 84 conformance cases. I also completed a controlled live create → edit → independently verify → delete smoke test against a temporary saved reply draft; no message was sent and the temporary draft was removed.

The fork-origin Test and Security workflows have remained at action required, so could a maintainer approve those runs when convenient? This PR includes the addressed-fields fix from #31 as its original isolated commit with authorship preserved. Would you prefer #31 merged first, or should I keep that prerequisite in this PR? I can split the feature into smaller review units if that would materially help, but have left the current mergeable, tested stack intact to avoid churn.