chore: sunset legacy storage surfaces (clean slate)

[MajorTal]

Summary

• Public-repo half of the gateway-side legacy storage shim sunset (kychee-com/run402#120). The four legacy MCP tools (upload_file, download_file, list_files, delete_file) and CLI run402 storage subcommand were registered but pointed at routes that 404 since the gateway's 2026-04-28 cutover.
• Pre-revenue clean-slate position: delete every reference, no migration tables, no "supersedes" mentions, no redirector stubs. New agents read new docs and discover blob_* in its own terms.
• Bumps run402-mcp, run402, @run402/sdk to 1.47.0 (minor — removal-of-functionality on the existing 1.x line).

What's deleted (handlers + CLI module + tests)

• src/tools/upload-file.ts, download-file.ts, list-files.ts, delete-file.ts, upload-file.test.ts
• cli/lib/storage.mjs, openclaw/scripts/storage.mjs
• 4 server.tool registrations + section banner from src/index.ts
• "Supersedes upload_file/download_file/list_files/delete_file" mentions stripped from the blob_* tool descriptions
• CLI dispatcher case "storage": block + HELP entry
• Storage-targeting test cases from cli-integration.test.ts and cli-e2e.test.mjs

What's scrubbed (docs + tests)

• SKILL.md, README.md, README.zh-CN.md, openclaw/SKILL.md, cli/llms-cli.txt — drop tool-table rows, deprecated sections, "Supersedes" callouts; swap upload_file examples for blob_put. Final grep returns zero matches.
• openclaw/SKILL.md "File Storage" REST section was rewritten to document the new direct-to-S3 flow (init → PUT → complete) since that file is curl-style API docs, not a tool list.
• sync.test.ts SURFACE rows + SDK_BY_CAPABILITY placeholders removed; legacy endpoints added to IGNORED_ENDPOINTS so the test stays green even while the upstream private-repo site/llms.txt may still list them.
• SKILL.test.ts, cli-help.test.mjs updated.
• Stray upload_file mention in src/tools/provision.ts:42 success text fixed.

OpenSpec

• New change at openspec/changes/sunset-legacy-storage-surfaces/ (proposal + design + spec delta + tasks). All 35 implementation tasks done; task 7.4 (post-merge archive) deferred.
• REMOVE delta applied to openspec/specs/incremental-deploy/spec.md (the dead "Upload file shows public URL" requirement).
• Marked obsolete carve-outs in openspec/changes/add-run402-sdk/tasks.md lines 44 and 84.

Backend pushback (informational)

The gateway returns Express's default 404 on the retired routes. A structured HTTP 410 Gone with {error, sunset_date, moved_to} JSON body would be more useful for any client. Not blocking this PR; flagged in design.md for the gateway team's next sunset.

Test plan

• npm run build — clean
• npm test — 422 unit + 271 e2e tests pass, 0 fail
• openspec validate sunset-legacy-storage-surfaces — valid
• Final grep for legacy refs across docs returns zero matches
• Final grep for legacy refs in source/tests returns only intentional IGNORED_ENDPOINTS entries

🤖 Generated with Claude Code