Update claude-api skill: scheduled deployments, vault env-var credentials, system.message events (#1297)

- Add Managed Agents scheduled deployments: new
  shared/managed-agents-scheduled-deployments.md (cron schedules, deployment
  runs, pause/auto-pause), Deployments and Deployment Runs API reference,
  beta-header coverage, and SKILL.md routing
- Vault environment_variable credentials: secrets substituted at egress with
  networking allowlists; secrets guidance in tools, client-patterns, and
  onboarding docs rewritten around them; self-hosted sandbox caveats noted
- Add system.message event for mid-session system prompt updates (Opus 4.8
  only) to the events guide and API reference

skills/claude-api/shared/managed-agents-self-hosted-sandboxes.md

@@ -156,6 +156,7 @@ These are **control-plane** calls — authenticate with `x-api-key` (not the env
 | Container lifecycle, hardening, networking | Anthropic | **You** — run non-root, read-only rootfs, drop caps; egress is whatever your VPC/firewall allows |
 | `file` / `github_repository` resource mounting | Anthropic mounts into the container | **You** — pass pointers via `sessions.create(metadata={...})` and have your orchestrator fetch/clone before dispatch |
 | `memory_store` resources | Supported | **Not yet supported** |
+| Vault `environment_variable` credentials | Supported (substituted at Anthropic-managed egress) | **Not yet supported** — egress is yours, so there's nowhere to substitute the secret. Use MCP credentials or a host-side custom tool (`shared/managed-agents-client-patterns.md` Pattern 9) |
 | Built-in tools | Via `agent_toolset_20260401` | Supplied by your worker (`EnvironmentWorker` default / `beta_agent_toolset(env)` / `ant` CLI fixed set) |
 | Skills download | Automatic | `EnvironmentWorker` / `AgentToolContext` fetch into `{workdir}/skills/` (needs `client` + `session_id`) |
 | Claude Platform on AWS | Supported | **Not available** |