feat(pilot): frontend API client — patchScript + inline createSession

sessionSuggestedFixesApi.patchScript(sessionId, fixId, script, params?)
hits the new PATCH /script endpoint.

scriptBuilder.createSession accepts an optional options bag with
origin + aiSessionId, defaulting to standalone when omitted so legacy
callers stay behavior-preserving.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/api/scriptBuilder.ts

@@ -7,9 +7,21 @@ import type {
 } from '@/types'
 import type { ScriptTemplateDetail } from '@/types'
 
+export interface CreateSessionOptions {
+  origin?: 'standalone' | 'pilot_inline'
+  aiSessionId?: string
+}
+
 export const scriptBuilderApi = {
-  async createSession(language: string): Promise<ScriptBuilderSessionDetail> {
-    const { data } = await apiClient.post('/scripts/builder/sessions', { language })
+  async createSession(
+    language: string,
+    options?: CreateSessionOptions,
+  ): Promise<ScriptBuilderSessionDetail> {
+    const { data } = await apiClient.post('/scripts/builder/sessions', {
+      language,
+      origin: options?.origin,
+      ai_session_id: options?.aiSessionId,
+    })
     return data
   },
 

frontend/src/api/sessionSuggestedFixes.ts

@@ -197,6 +197,28 @@ export const sessionSuggestedFixesApi = {
     return r.data
   },
 
+  /**
+   * Attach an engineer-drafted script to a suggested fix (inline Script
+   * Builder Submit path). Does NOT stamp applied_at — the server treats
+   * a draft as non-terminal progress. Bumps state_version so the
+   * Resolve/Escalate preview regenerates.
+   */
+  async patchScript(
+    sessionId: string,
+    fixId: string,
+    aiDraftedScript: string,
+    aiDraftedParameters?: Record<string, unknown>,
+  ): Promise<SessionSuggestedFix> {
+    const r = await apiClient.patch<SessionSuggestedFix>(
+      `/ai-sessions/${sessionId}/suggested-fixes/${fixId}/script`,
+      {
+        ai_drafted_script: aiDraftedScript,
+        ai_drafted_parameters: aiDraftedParameters,
+      },
+    )
+    return r.data
+  },
+
   /**
    * Explicitly dismiss the AI-proposed outcome banner ("Not yet").
    * Clears ai_outcome_proposal on the server without touching status or