fix(reference): harden the public OpenAPI contract

[muxx]

Context

The documentation reference must expose the supported public API surface without leaking internal or deprecated fields. The source OpenAPI security declarations mix public, deprecated, authentication-provider, and administrative alternatives, while the documentation still needs a stable authorization description for every published operation.

Changes

• centralize the client-safe and documentation-safe OpenAPI filtering policy
• remove unsupported volume mounts, deprecated fields, internal tokens, operation security declarations, and security scheme definitions from documentation specs
• validate removed references, forbidden fields, and generated Markdown
• publish normalized auth metadata in reference/openapi/operations.json
• expose required X-API-Key auth for control-plane operations, no auth for envd health, and optional X-Access-Token auth for the remaining public envd operations
• fail generation when an authenticated public operation has no allowed or unambiguous public auth mechanism
• require English for repository artifacts, commits, and GitHub pull requests in CLAUDE.md/AGENTS.md

The manifest remains at schemaVersion 1 because the reference contract has not been published to production yet.

Verification

• make generate
• deterministic second generation with an identical working-tree patch
• pnpm format:check
• pnpm lint
• pnpm typecheck
• pnpm test
• scripts/build-release.sh
• node scripts/check-public-artifacts.mjs release
• scripts/test-release-artifacts.sh
• downstream docs synchronization, checks, build, and bundle budgets