serve: bound the CloudEvents id on consume, catch DriverError from idempotency_release, declare Idempotency-Key maxLength in OpenAPI #261

Context

PR #259 (#258) bounded the Idempotency-Key header at 255 bytes (400 idempotency-key-too-long) and moved the rollback before idempotency_release on the event-consume failure path. Three neighbouring gaps were found during that work and left out of scope.

1. CloudEvents id on the consume route is unbounded

POST /-/events/<slug> keys its idempotency claim on the CloudEvents id (impl/lnpl/wsgi.py _respond_event_consume). That key lands in the same lnpl_idempotency (workflow_id, key) btree index on lnpl-postgres, so an id of about 4000 characters fails with an unhandled 500, the same failure #258 fixed for the header. The CloudEvents spec sets no maximum length, so the bound and its status code need a decision.

2. DriverError from idempotency_release escapes as a raw 500

On the consume escape path, a DriverError raised by idempotency_release itself is not caught and leaves the WSGI app as a raw 500. This predates #258 and was not made worse by it.

3. OpenAPI does not declare the header bound

impl/lnpl/openapi.py:592 declares Idempotency-Key as {"type": "string"} with no maxLength: 255. Adding it changes 7 golden files.

Done when

• Each item fixed (or explicitly decided against) with a test; Postgres behaviour pinned via the TCK or lnpl-postgres where relevant.