fix(api): align ConflictOut OpenAPI response with runtime schema fields

[wylovelyi]

Summary

Closes #1440.

The conflict-review routes (GET /api/v1/conflicts, GET /api/v1/conflicts/{conflict_id}, PATCH /api/v1/conflicts/{conflict_id}/resolve) serialize the runtime core_api.schemas.ConflictOut, but their responses={200: {"model": ...}} decorators point at the smaller spec-only core_api.openapi_responses.ConflictOut, which omitted 7 fields the handler actually emits.

This is a spec-only change — the OpenAPI response model is documentational (it is not used as response_model=, so no wire/runtime serialization changes). It now declares the same fields the runtime model does:

• fleet_id
• relationship_confidence
• diagnosis_confidence
• evidence_strength
• audit_reason
• created_by
• created_at

Types follow the existing spec-only model's conventions (str for ids/timestamps, float | None for the confidence scores), matching what _MEMORY_CONFLICT_FIELDS / core_api.schemas.ConflictOut carry.

Regression test

Added tests/test_d11_conflict_openapi_parity.py, which asserts the spec-only ConflictOut documents every field the runtime ConflictOut serializes. This ratchets against future drift between the two models — the exact cause of #1440.

Notes

• No runtime serialization change (spec-only model, per C33 design).
• Generated OpenAPI artifacts are produced from the route decorators at build time, so the Python model change is sufficient; nothing else needed editing.

[wylovelyi]

Hi maintainers 👋

Brought this onto the latest main (merge commit, branch head 583d8e4b). Posting a short summary since the PR has been open a bit.

What this PR does
Aligns the ConflictOut OpenAPI response schema (core-api/src/core_api/openapi_responses.py) with the fields the runtime actually returns for the D11 conflict feature. The spec was missing 7 fields that the service emits:

• fleet_id
• relationship_confidence
• diagnosis_confidence
• evidence_strength
• audit_reason
• created_by
• created_at

Added tests/test_d11_conflict_openapi_parity.py as a regression guard so these fields can't silently drift from the model again (it asserts the required field set on ConflictOut).

Closes #1440. 2 files, +50 / -0.

CI status — all green:

• CI, CodeQL, Security Scan (bandit + pip-audit)
• Legacy-name ratchet (×2), Do-not-touch sentinel, pre-checks
• dco, core-api image bakes a real version, Analyze (python) + Analyze (javascript-typescript)

(The claude-* checks are skipped — not configured on the fork.)

The branch is a merge of main rather than a rebase; happy to rebase to a linear history if you'd prefer that before merging. Ready for review whenever you have a moment — thanks!

[erni-a]

Thanks @wylovelyi, and sorry this sat ten days. Verified against main: the seven fields match the runtime ConflictOut in schemas.py (float for the two confidences, str for the rest, created_at as an ISO string like resolved_at already is in this spec-only model), and the parity test lives in the root tests/ suite that CI runs. Merging; it will be behind main by the time its turn comes, so I will update the branch myself.