Claude SDK for Go 1.71.0

Apply the Go 1.27 baseline first. These rules cover github.com/anthropics/anthropic-sdk-go v1.71.0, whose minimum Go version is 1.24. Apply the relevant sections to first-party clients, cloud adapters, Messages tools, local executors, managed agents, and organization administration.

Client identity, credentials, and workspace scope

• Construct separate clients for each tenant, workspace, environment, and privilege tier; keep client options and tenant bindings immutable after construction.
• Load option.WithAPIKey, option.WithAuthToken, and federation providers from trusted secret configuration, and select exactly one authentication mode. WithAuthToken adds Authorization without removing an existing X-Api-Key; when switching an API-key client to an environment bearer token, explicitly use option.WithHeaderDel("X-Api-Key") too.
• Pass option.WithoutEnvironmentDefaults() to anthropic.NewClient when the host environment and profile directory are not trusted configuration boundaries. The marker acts at client construction; passing it to an individual request does not undo inherited defaults or disable Go's proxy environment handling.
• Account for default credential precedence: API key, auth token, explicit ANTHROPIC_PROFILE, environment federation, then active/default profile. Validate the intended identity before serving traffic; profile errors can surface only on the first request, and explicit credentials can shadow profile authentication while its workspace header and base URL still apply.
• Set FederationOptions.FederationRuleID,