Fix internal/handler test failures, align response with Python contract, and re-enable handler/storage/agent tests in CI (#17554)

## Summary

Fixes the 6 pre-existing failures in `internal/handler`, aligns one
response
field with the Python API contract, and re-enables packages in CI that
were
previously excluded because of (or unrelated to) those failures.

### Test/handler fixes
- **plugin.go**: return `"success"` (lowercase) instead of `"SUCCESS"`
so the
response envelope matches the Python backend, keeping backend-swap
transparent.
- **search_handler_test.go**: expect lowercase `"no authorization"` to
match the
  service error message, which mirrors Python.
- **agent_test.go**: seed versions with `CreateTime` instead of
`UpdateTime` so
  `ListVersions` ordering (`create_time DESC`) is exercised correctly.
- **agent_wait_for_user_test.go**: a clean run may emit only the
`[DONE]` frame;
relax the SSE assertion to require a non-empty stream ending in
`[DONE]`.
- **bot_test.go**: align attachment-download assertions with actual
behavior
  (`Content-Disposition: attachment; filename="file"`, default
`application/octet-stream`), matching Python
`resolve_attachment_content_type`.

### CI
- **tests.yml / sep-tests.yml**:
- Remove the `grep -v '/internal/handler$'` filter — the 6 failures that
    motivated it are now fixed.
- Remove the `grep -v '/internal/storage$'` filter — `internal/storage`
tests self-skip via `t.Skipf` when MinIO is unavailable, so the package
is
    safe to run in CI.
  - Remove the `grep -v '/internal/agent$'` filter (only present in the
tests.yml infinity job) — the exclusion was undocumented and
inconsistent
    with the other jobs that already run `internal/agent`.
- Keep the `internal/tokenizer` exclusion: it is a genuine environmental
dependency (dict files at `/usr/share/infinity/resource`, absent in the
Go
    test environment).

## Test plan

- `build.sh --test ./internal/handler/` is green (previously 6 FAIL).
- `build.sh --test ./internal/storage/ ./internal/agent/` should pass;
the
MinIO-backed `internal/storage` tests skip gracefully without a MinIO
server.
- After this PR, `internal/handler`, `internal/storage`, and
`internal/agent`
  run again in CI unit-test jobs; `internal/tokenizer` stays excluded.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

.github/workflows/sep-tests.yml

@@ -322,20 +322,13 @@ jobs:
         #
         # Excludes packages whose tests fail for environmental reasons
         # unrelated to the diff:
-        #   - internal/storage:   TestMinioStorage_* needs a MinIO server
-        #     at localhost:9000; not started by this job.
         #   - internal/tokenizer: tests need /usr/share/infinity/resource
         #     dict files, only mounted inside the docker builder, not
         #     in the Go test environment.
-        #   - internal/handler:   TestListAgentVersionsHandler_Success and
-        #     sqlite setup (e.g. "no such table: user_tenant") are
-        #     pre-existing flakes unrelated to the diff.
         run: |
           set -euo pipefail
           PKGS=$(go list ./... 2>/dev/null \
-            | grep -v '/internal/storage$' \
-            | grep -v '/internal/tokenizer$' \
-            | grep -v '/internal/handler$' || true)
+            | grep -v '/internal/tokenizer$' || true)
           if [ -z "$PKGS" ]; then
             ./build.sh --test
           else
@@ -902,20 +895,13 @@ jobs:
         #
         # Excludes packages whose tests fail for environmental reasons
         # unrelated to the diff:
-        #   - internal/storage:   TestMinioStorage_* needs a MinIO server
-        #     at localhost:9000; not started by this job.
         #   - internal/tokenizer: tests need /usr/share/infinity/resource
         #     dict files, only mounted inside the docker builder, not
         #     in the Go test environment.
-        #   - internal/handler:   TestListAgentVersionsHandler_Success and
-        #     sqlite setup (e.g. "no such table: user_tenant") are
-        #     pre-existing flakes unrelated to the diff.
         run: |
           set -euo pipefail
           PKGS=$(go list ./... 2>/dev/null \
-            | grep -v '/internal/storage$' \
-            | grep -v '/internal/tokenizer$' \
-            | grep -v '/internal/handler$' || true)
+            | grep -v '/internal/tokenizer$' || true)
           if [ -z "$PKGS" ]; then
             ./build.sh --test
           else

.github/workflows/tests.yml

@@ -197,21 +197,13 @@ jobs:
         #
         # Excludes packages whose tests fail for environmental reasons
         # unrelated to the diff:
-        #   - internal/storage:   TestMinioStorage_* needs a MinIO server
-        #     at localhost:9000; not started by this job.
         #   - internal/tokenizer: tests need /usr/share/infinity/resource
         #     dict files, only mounted inside the docker builder, not
         #     in the Go test environment.
-        #   - internal/handler:   TestListAgentVersionsHandler_Success and
-        #     sqlite setup (e.g. "no such table: user_tenant") are
-        #     pre-existing flakes unrelated to the diff.
         run: |
           set -euo pipefail
           PKGS=$(go list ./... 2>/dev/null \
-            | grep -v '/internal/storage$' \
-            | grep -v '/internal/agent$' \
-            | grep -v '/internal/tokenizer$' \
-            | grep -v '/internal/handler$' || true)
+            | grep -v '/internal/tokenizer$' || true)
           if [ -z "$PKGS" ]; then
             ./build.sh --test
           else
@@ -645,20 +637,13 @@ jobs:
         #
         # Excludes packages whose tests fail for environmental reasons
         # unrelated to the diff:
-        #   - internal/storage:   TestMinioStorage_* needs a MinIO server
-        #     at localhost:9000; not started by this job.
         #   - internal/tokenizer: tests need /usr/share/infinity/resource
         #     dict files, only mounted inside the docker builder, not
         #     in the Go test environment.
-        #   - internal/handler:   TestListAgentVersionsHandler_Success and
-        #     sqlite setup (e.g. "no such table: user_tenant") are
-        #     pre-existing flakes unrelated to the diff.
         run: |
           set -euo pipefail
           PKGS=$(go list ./... 2>/dev/null \
-            | grep -v '/internal/storage$' \
-            | grep -v '/internal/tokenizer$' \
-            | grep -v '/internal/handler$' || true)
+            | grep -v '/internal/tokenizer$' || true)
           if [ -z "$PKGS" ]; then
             ./build.sh --test
           else