sdk: name the v0 modules for the surface they serve

.claude/agents/sdk-sync-checker.md

@@ -67,10 +67,10 @@ Details:
 
 ## Locations
 - Protos: `dstack/guest-agent/rpc/proto/*.proto`
-- Python: `sdk/python/src/dstack_sdk/dstack_client.py`
-- Go: `sdk/go/dstack/client.go`
-- Rust: `sdk/rust/types/src/dstack.rs`
-- JS: `sdk/js/src/index.ts`
+- Python: `sdk/python/src/dstack_sdk/dstack_client_v0.py`, `dstack_client_v1.py`
+- Go: `sdk/go/dstack/client_v0.go`, `client_v1.go`
+- Rust: `sdk/rust/types/src/dstack_v0.rs`, `dstack_v1.rs`
+- JS: `sdk/js/src/client-v0.ts`, `client-v1.ts`
 - Docs: `sdk/curl/api.md`, `sdk/curl/api-tappd.md`
 
 Focus on API surface differences. Provide specific file paths and line numbers.

CHANGELOG.md

@@ -61,6 +61,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - sdk: the Go SDK's v1 `IssueCert` defaults `usage_server_auth` to true, as the Rust, Python and JavaScript v1 clients already did. Go was the odd one out, so the same argument-free call produced a certificate that could serve TLS in three languages and one that could not in the fourth — and a certificate you cannot serve with is useless to most callers. `WithCertUsageServerAuth(false)` opts out. v0's `GetTlsKey` keeps its `false` default deliberately: that is what the released 0.5.x Go SDK sent, and `DstackClientV0` mirrors released behaviour rather than the better choice
 - sdk: the JavaScript v1 `issueCert` response no longer carries a raw-bytes accessor. `asUint8Array()` is **removed rather than renamed**: it existed to feed the private key into the blockchain adapters, and v1 has no chain-flavoured surface. `IssueCert` returns TLS material, PEM is the form a TLS stack takes, and a caller who genuinely needs DER converts it with a standard library. The Rust, Python and Go v1 clients already returned the PEM string and the chain alone, so all four now agree. v0's `GetTlsKeyResponse.asUint8Array` is untouched — released API, and the viem and solana adapters depend on its truncating behaviour
 - sdk: the JavaScript v1 GPU evidence bundle's `asUint8Array()` is renamed `decodeEvidence()`, matching Python's and Rust's `decode_evidence` and Go, which hands back the decoded `Evidence` bytes directly. The name now says what the bytes are — the vendor's evidence, hex off the wire and decoded byte-exact, because sha256 over precisely those bytes is what the measured `gpu-attestation` event commits to
+- sdk: the v0 modules carry a `_v0` suffix, so the file a reader opens matches the client it holds. Rust's `dstack_sdk::dstack_client` becomes `dstack_sdk::dstack_client_v0` and `dstack_sdk_types::dstack` becomes `dstack_sdk_types::dstack_v0`; Python's `dstack_sdk.dstack_client` becomes `dstack_sdk.dstack_client_v0`; Go's `client.go`/`client_test.go` become `client_v0.go`/`client_v0_test.go`; and the JavaScript `index.ts`, which held both surfaces in one file, splits into `client-v0.ts`, `client-v1.ts` and a `shared.ts`, leaving `index.ts` as a barrel that re-exports exactly the names it always did. Until now the unsuffixed *file* meant v0 while the unsuffixed *class* meant v1, so a reader opening `dstack_client.rs` for the recommended client found the legacy one instead. **There are deliberately no backward-compat module aliases**: 0.6.0 is the loud-break release, and an import of an old module path fails at build time rather than silently binding the frozen surface under a name that now means something else. Package-level exports are untouched in every SDK — `dstack_sdk::DstackClient`, `from dstack_sdk import DstackClientV0` and `@phala/dstack-sdk`'s public surface are exactly what they were; only a deep import of the module path moves. In Go this is file naming alone, since it is all one `package dstack`
+- sdk: the v0 clients are deprecated in the way each language's tooling understands, not only in prose. Rust's `DstackClientV0` and `TappdClient` carry `#[deprecated(since = "0.6.0")]`, so a downstream build warns at every mention of the type — the `use`, the constructor, any signature naming it. Method calls on an already-built client stay silent, because Rust does not propagate the attribute to inherent methods. Python's `DstackClientV0` and `AsyncDstackClientV0` emit a `DeprecationWarning` on construction, through the same helper `TappdClient` already used, alongside the `.. deprecated:: 0.6.0` docstring note they already carried. JavaScript's `DstackClientV0` already had its `@deprecated` JSDoc and `TappdClient` gains one. Go's `// Deprecated:` markers were in place but seven sat mid-comment rather than as their own trailing paragraph, which is the only form gopls and pkg.go.dev recognise, and are repaired.
+
+  Nothing is removed and the wire behaviour is unchanged, but Python's marker is a runtime warning rather than a build-time one: a downstream test suite that turns `DeprecationWarning` into an error (`filterwarnings = error`, which is a common setting) will fail on `DstackClientV0()` until it adds a filter. The frozen surface stays reachable under its explicit name; it just says what it is now
 
 
 ### Removed

sdk/go/dstack/client.go → sdk/go/dstack/client_v0.go

@@ -575,12 +575,14 @@ func (c *DstackClientV0) EmitEvent(ctx context.Context, event string, payload []
 // Legacy methods for backward compatibility with warnings
 
 // DeriveKey is deprecated. Use GetKey instead.
+//
 // Deprecated: Use GetKey instead.
 func (c *DstackClientV0) DeriveKey(path string, subject string, altNames []string) (*GetTlsKeyResponse, error) {
 	return nil, fmt.Errorf("deriveKey is deprecated, please use GetKey instead")
 }
 
 // TdxQuote is deprecated. Use GetQuote instead.
+//
 // Deprecated: Use GetQuote instead.
 func (c *DstackClientV0) TdxQuote(ctx context.Context, reportData []byte, hashAlgorithm string) (*GetQuoteResponse, error) {
 	c.logger.Warn("tdxQuote is deprecated, please use GetQuote instead")
@@ -601,6 +603,7 @@ type TappdClient struct {
 }
 
 // NewTappdClient creates a new deprecated TappdClient.
+//
 // Deprecated: Use NewDstackClient instead.
 func NewTappdClient(opts ...DstackClientOption) *TappdClient {
 	// Create a modified option to use TAPPD_SIMULATOR_ENDPOINT
@@ -632,6 +635,7 @@ func NewTappdClient(opts ...DstackClientOption) *TappdClient {
 // Override deprecated methods to use proper tappd RPC paths
 
 // DeriveKey is deprecated. Use GetKey instead.
+//
 // Deprecated: Use GetKey instead.
 func (tc *TappdClient) DeriveKey(ctx context.Context, path string, subject string, altNames []string) (*GetTlsKeyResponse, error) {
 	tc.logger.Warn("deriveKey is deprecated, please use GetKey instead")
@@ -661,6 +665,7 @@ func (tc *TappdClient) DeriveKey(ctx context.Context, path string, subject strin
 }
 
 // TdxQuote is deprecated. Use GetQuote instead.
+//
 // Deprecated: Use GetQuote instead.
 func (tc *TappdClient) TdxQuote(ctx context.Context, reportData []byte, hashAlgorithm string) (*GetQuoteResponse, error) {
 	tc.logger.Warn("tdxQuote is deprecated, please use GetQuote instead")

sdk/go/dstack/ethereum.go

@@ -23,6 +23,7 @@ type EthereumAccount struct {
 }
 
 // ToEthereumAccount creates an Ethereum account from GetKeyResponse or GetTlsKeyResponse (legacy method).
+//
 // Deprecated: Use ToEthereumAccountSecure instead. This method has security concerns.
 func ToEthereumAccount(keyResponse interface{}) (*EthereumAccount, error) {
 	switch resp := keyResponse.(type) {

sdk/go/dstack/solana.go

@@ -20,6 +20,7 @@ type SolanaKeypair struct {
 }
 
 // ToSolanaKeypair creates a Solana keypair from GetKeyResponse or GetTlsKeyResponse (legacy method).
+//
 // Deprecated: Use ToSolanaKeypairSecure instead. This method has security concerns.
 func ToSolanaKeypair(keyResponse interface{}) (*SolanaKeypair, error) {
 	switch resp := keyResponse.(type) {