feat(spec): add OpenAPI 3.1 specification lock, catalog generator, and coverage tracking

[robbecker-wf]

Stacked PR: Part 1 of 7

Stack Overview:

1. #443 10x-openapi-spec-baseline (this PR) -> 10x
2. #444 10x-security-and-transport -> 10x-openapi-spec-baseline
3. #445 10x-service-contracts-conformance -> 10x-security-and-transport
4. #446 10x-schema-models-and-strict-analysis -> 10x-service-contracts-conformance
5. #447 10x-test-pyramid-and-smoke -> 10x-schema-models-and-strict-analysis
6. #448 10x-ci-and-spec-sync -> 10x-test-pyramid-and-smoke
7. #449 10x-conformance-plan -> 10x-ci-and-spec-sync

---

Summary

Establishes a reproducible OpenAPI 3.1 specification baseline pinned to GitHub's REST API description (2022-11-28).

• Lockfile: Pinned upstream commit, SHA-256 digest, OpenAPI version, and generator schema in tool/spec/github-openapi.lock.json.
• Spec Loader & Generator: Added OpenAPI loader with $ref resolution and deterministic generator producing immutable REST contracts in lib/src/common/generated/rest_contracts.g.dart (1,229 operations).
• Bindings Manifest & Coverage: Tracked supported/partial/deprecated service bindings in tool/spec/bindings.yaml and generated documentation in docs/api-coverage.md.
• Tooling & Validation: Added tool/spec_sync.dart supporting --check, --update, --offline, and --report-json; added regression tests in test/unit/spec_sync_test.dart.