Managed settings gain a gateway probe and signed proof of absence

What

Managed settings are settings an organisation pushes to Claude Code. Two new pieces deal with where they come from:

• A gateway probe requests /managed/settings in a status-only mode, with a custom User-Agent (claude-cli/<version> (external, ...)), If-None-Match: * and no-cache headers, and closes the response after reading the headers. It decides a gateway owns the settings only when an x-cc-gateway-version header is present and cache-control contains no-store. A 304 answer counts as yes, a 404 as no, and anything else as unknown. No caller of the probe was traced, so it may not be in use yet.
• The signature check for managed settings and plugins now accepts a second kind of document saying that no settings exist (an absence document), with an abs flag, an optional exp expiry and a plan. A valid result now says whether it is an absence or a normal document.
• New failure reasons are unsupported_version and abs_mismatch.
• The window for treating a document as fresh is now capped by the document's own expiry, not only a fixed maximum age per type.

Why

This is groundwork. It lets Claude Code verify that an organisation truly has no managed settings, for a limited time, and work out whether a gateway is serving them.