fix: describe the whole API in openapi.json, not the read half

[AKogut]

Closes the last observation from the audit.

What was wrong

/openapi.json was generated from READ_ROUTES, so it advertised 7 endpoints out of 18:

before                     after adds
GET /v1/runs               POST /v1/ingest
GET /v1/runs/{runId}       POST /v1/ingest/junit
GET /v1/tests/{id}         POST /v1/traces
GET /v1/flaky              POST /v1/artifacts/presign
GET /v1/executions/…/rca   POST /v1/tests/{id}/quarantine
GET /v1/health             PUT  /v1/codeowners
GET /v1/export             PUT  /v1/notifications/routing
                           GET  /v1/runs/summary
                           GET  /v1/runs/gate
                           GET  /health, /openapi.json

Everything a client would actually write to was missing, and nothing in the document said a fraction was on offer. Meanwhile the human reference was generated from REST_ENDPOINTS and had all eighteen — two descriptions of one API, free to disagree.

Now

One table, REST_ENDPOINTS, two renderings. Request bodies come from the zod schemas the endpoints already validate against, so the specification cannot describe a body the server would reject.

Schemas are inlined, not named. Passing a name to zodToJsonSchema puts the schema under definitions and leaves a $ref pointing where OpenAPI does not look — I generated it that way first, saw $ref + definitions in the served document, and changed it, because a generated client cannot resolve that. Verified on the live API: zero #/definitions references remain.

Four guards

A specification that drifts is worse than none — it is wrong with authority.

• every documented endpoint appears in the document
• every endpoint taking a body describes one
• the liveness probe is not marked as needing a token — a document that demands auth for /health teaches people to ignore its security blocks entirely
• every path parameter a URL names is declared, or no generated client can build that URL

The pre-existing assertion that counted paths against READ_ROUTES now checks them against the documented endpoints instead, and a new one keeps every read route in REST_ENDPOINTS.

Verified live

$ curl -s localhost:4000/openapi.json | jq '[.paths[] | keys[]] | length'
18

$ … .paths["/v1/ingest"].post.requestBody…schema | {type, required}
{"type":"object","required":["contractVersion","idempotencyKey","resource","run","executions"]}

$ … .paths["/health"].get.security
[]

62/62 turbo tasks.