refactor: keep ConnectionManager internal, preserve public API @W-22389160@

[shetzel]

Summary

Refactor of #278 that keeps the connection-isolation fix but eliminates the breaking changes to the public API.

• ConnectionManager is internal — never exported, never appears in any public type (BaseAgentConfig, ScriptAgentOptions, ProductionAgentOptions revert to their main-branch shape).
• ConnectionManager.create() builds two fresh Connection objects from the username via AuthInfo.create() instead of mutating the caller's Connection. The supplied connection is read-only.
• AgentBase keeps its protected readonly connection: Connection property and restoreConnection() signature. JWT access goes through a new protected getJwtConnection() helper.
• ScriptAgent, ProductionAgent, and ScriptAgentPublisher constructors accept an optional internal-only connectionManager as a second positional parameter; direct instantiation (e.g., new ProductionAgent({ connection, ... })) continues to work as on main.

The library-internal clobbering scenario remains fixed: getStandardConnection() returns a fresh connection that never holds a JWT, so SOQL/tooling auto-refresh cannot overwrite the JWT used for SFAP requests.

Test plan

• yarn lint — 0 errors (warnings are pre-existing on main)
• yarn compile — clean
• yarn test — 300 passing, 1 pending (pre-existing skip unrelated to this work)
• New test/connectionManager.test.ts — 8 tests covering: missing-username error, no-mutation guarantee, distinct JWT/standard connection objects, malformed token, expired token, inspectJwt claim parsing, refreshStandardConnection only touches the standard side
• Replace the four it.skip tests from fix: add connectionManager @W-22389160@ #278: the two in test/utils.test.ts tested an unimplemented JWT guard and are deleted (the new architecture doesn't need a guard); the two in test/agentPublisher.test.ts tested the old try/finally refreshAuth and are replaced by a new test asserting the no-mutation contract during publish
• git diff main -- src/types.ts src/index.ts — empty (public type surface matches main)
• Re-run NUTs against a real org

🤖 Generated with Claude Code