feat(sdk): allow graph creation without explicit secrets

[breken-ai]

Closes #631.

What changes

StateManager.upsert_graph(graph_name, graph_nodes, secrets=None, …): the secrets mapping is optional. A graph that needs none is created without passing {}.

What deliberately does not change

The wire contract. The state manager's UpsertGraphTemplateRequest requires secrets, and GraphTemplate.set_secrets replaces a graph's stored secrets on every upsert. So an omitted argument is sent as an empty mapping, exactly what callers send today, and the docstring and README say in one sentence that omitting it when updating a graph that already has secrets clears them. Preserving them client-side is not possible (the API returns only secret names), so that would be a server change and is out of scope here. The body carries a copy of the caller's mapping (it was passed by reference before), and there is no shared mutable default.

Tests

python-sdk/tests/test_statemanager_optional_secrets.py, against a mocked aiohttp session that captures the PUT body:

• omission → "secrets": {} on the wire, call succeeds
• explicit mapping → sent unchanged, caller's dict not mutated, body holds a copy
• two calls without secrets → no shared mutable default
• positional call with secrets third → still binds

Before: 3 failed, 1 passed (TypeError: missing 1 required positional argument: 'secrets'; body was the caller's own dict). After: 4 passed; full SDK suite 178 passed; ruff check . clean.

Evidence record

Repository / issue:        FailproofAI/runtime #631
Upstream SHA / patch SHA:  2db4b154 / 0a8f982
Issue ownership:           open, unassigned, no linked or competing PR (checked 2026-09-12 21:41 UTC)
Server contract checked:   state-manager/app/models/graph_models.py (secrets required), controller/upsert_graph_template.py + models/db/graph_template_model.py:set_secrets (replace on every upsert)
Reproducer:                uv run pytest tests/test_statemanager_optional_secrets.py → 3 failed, 1 passed on 2db4b154
Patched:                   4 passed; uv run pytest → 178 passed; uv run ruff check . → clean
Checks not executed:       disposable-namespace integration against a live state manager
Contract decision open:    whether the server should ever preserve secrets on omission (not changed here)