ci: add OpenAPI drift-gate workflow (follow-up to #1342)

[strausmann]

Proposed change

Adds .github/workflows/openapi.yml — the OpenAPI drift gate that #1341/#1342 introduced alongside the generator. The cherry-pick pulled in scripts/generate-openapi.ts and the generate:openapi:check script, but not this workflow, so nothing currently enforces the check in CI. At runtime it's harmless (the prebuild hook regenerates the spec on every build), but a stale committed src/lib/openapi.generated.json / static/openapi.json would not be caught.

The job runs npm run generate:openapi:check on pushes to main and on PRs that touch the route code, hooks, or the generator, and fails if the committed spec drifts from the route code. It also uploads the generated static/openapi.json as a debug artifact.

Two small cleanups vs. the copy in #1341/#1342:

• Dropped a stale code comment that pointed to a research doc living in an external repo (not present here).
• Added permissions: contents: read (least privilege — the job only checks out and runs the generator), matching the explicit-permissions style already used in release.yml.

CI only — no runtime or app-code changes.

Follow-up to #1342 (no separate issue).

Type of change

• Other. Please explain: CI-only — adds the drift-gate workflow that was left out of the feat(docs): OpenAPI 3 spec + Scalar UI — alternative rendering with multi-language code samples #1342 cherry-pick.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.