api+agent: document protocol-version stability and forget back-compat decisions

version.go: add a comment block explaining why Phase 5's wire changes
(CommandRunPayload, ConfigUpdatePayload, RepoStatsPayload reshapes) did
not bump CurrentProtocolVersion — lockstep deploy, no rolling-upgrade
path, smoke env restage enforces it. Notes where a version bump to 2
would be required if a multi-version path is ever introduced.

cmd/agent/main.go: document why the JobForget handler hard-errors on
empty ForgetGroups rather than falling back to a single-policy form.
The maintenance ticker is the only writer and always populates the
field; the fallback was specced but skipped given lockstep deploy.

cmd/agent/main.go

@@ -336,6 +336,13 @@ func (d *dispatcher) runJob(ctx context.Context, p api.CommandRunPayload, tx wsc
 		}()
 	case api.JobForget:
 		if len(p.ForgetGroups) == 0 {
+			// Hard-error rather than fall back to a single-policy form:
+			// the server-side dispatch path (maintenance ticker) is the
+			// only writer of forget command.run today, and it always
+			// populates ForgetGroups. A backwards-compatible single-
+			// policy fallback was specced but skipped — see the
+			// Phase 5 plan rationale and version.go's lockstep-deploy
+			// note for why.
 			return fmt.Errorf("forget: command.run carried no forget_groups (server didn't populate them)")
 		}
 		groups := make([]restic.ForgetGroup, 0, len(p.ForgetGroups))