Migrate .NET SDK from AAuth draft-08 to draft-09

[nedruk]

Summary

Vendor AAuth protocol draft-09 and migrate the .NET SDK from draft-08 to the new wire behavior.

The immutable draft-09 snapshot is pinned to:

• Tag: draft-hardt-oauth-aauth-protocol-09
• Commit: 90089f80eaccccbd22e32e06946e2aa08f7d67fe
• Datatracker: https://datatracker.ietf.org/doc/draft-hardt-oauth-aauth-protocol/09/

Work

• Vendor the complete aauth-spec/v09/ snapshot.
• Update SPEC-VERSION.md and CHANGELOG.md.
• Research repository impact and prepare an implementation plan.
• Adopt RFC 9457 application/problem+json error responses.
• Replace error_description/ErrorDescription with detail/Detail.
• Include existing R3 runtime errors in the RFC 9457 cutover.
• Add required clarification POST actions:
  • clarification_response
  • updated_request
• Reject missing or unknown clarification actions with HTTP 400.
• Update affected compiled samples and tests.
• Sweep documentation, snippets, READMEs, e2e assertions, and version tracking.
• Create separate implementation plans for deferred companion work.
• Complete independent final review.

Deferred implementation

These require separate implementation initiatives:

• AAuth Events and R3 AsyncAPI support
• HTTP Signature Keys self-jwt
• Access Server clarification handling
• Bootstrap/MockAgentProvider problem-details normalization

Validation

Each implementation phase must pass:

make build
make test-unit
make test-conformance
make e2e

References

• aauth-spec/v09/
• .agent/plans/2026-07-19-aauth-v09-spec-migration/research.md
• .agent/plans/2026-07-19-aauth-v09-spec-migration/implementation-plan.md