feat: add a required first-token event to the transport port

Transport.complete gains the keyword-only first_token_event (no default,
per the port convention): streaming sets it on the first delta, the
non-streaming path accepts it but never sets it, None means the caller
does not observe the first token. All fake/wrapping transports and the
three direct call sites follow the signature; the e2e wrapper forwards.

Red-green evidence: tests/outputs/137/t1/ (batch A TypeError red, then
147 file tests + 1550 unit tests green).

tests/unit/test_live_evidence.py

@@ -277,6 +277,7 @@ async def _complete(observed, *, call_id="a", stream=False):
         overlay={},
         call_id=call_id,
         reasoning_effort=None,
+        first_token_event=None,
     )
 
 
@@ -1266,6 +1267,7 @@ async def test_structured_first_attempt_requires_exact_initial_messages():
                 overlay={},
                 call_id="first",
                 reasoning_effort=None,
+                first_token_event=None,
             )
         event = capture.attempts(session_id="first", parent_call_id="parent")[0].http[0]
         assert not request_is_valid(event)