fix: preserve SDK baselines during generation

[dandorman]

Summary

SDK generation currently compares compatibility after generating, but only Node receives the existing API surface as a generation input. The Go/Kotlin/PHP emitters need that baseline to retain public aliases and avoid moving existing positional arguments when the spec adds fields.

• Extract the existing surface before overwriting a previously generated Go, Kotlin, or PHP SDK, then pass it through the existing --api-surface option.
• Leave fresh SDK generation and other languages unchanged.
• Keep the EXIT trap active so temporary surfaces and Node worktrees are cleaned up; extraction/generation failures still fail the command.

Companion to workos/oagen-emitters#260. No spec/API change, new CI pipeline, or SDK compilation harness is introduced.

Validation

• Six CLI-boundary tests cover all three languages, fresh generation, paths with spaces, extraction failure, generation failure, and temporary-file cleanup. They mock the npx boundary to inspect arguments; they do not compile or execute generated SDKs.
• The new tests fail against the previous script and pass here.
• Full npm test: 153 passed, zero skipped. bash -n scripts/sdk-generate.sh passed. npm run build:policy passed with the existing TypeScript 7 experimental-API warning.
• In the emitter companion, current-spec/policy generation using surfaces extracted from the original language PR bases preserves Kotlin's access-token slot, PHP's organization-ID slot, and Go's old credential type alias, including after another extract/generate cycle.

Rollout

Keep this draft until the emitter companion is released and this repository installs that version. This PR deliberately does not pin an unpublished Git dependency or publish a package. The full consumer SDK build/test matrix still needs to run with that candidate; source generation and script-unit results are not a replacement for it.