Enforce complete public reference contract

[muxx]

Summary

• prune public OpenAPI components to the transitive closure reachable from published operations
• exclude internal, private, and protected TypeScript declarations from generated reference
• recursively render nested request and response schemas with cycle-safe dotted field paths
• preserve response headers, referenced enum values, oneOf/discriminator variants, allOf composition, nullable types, root schema descriptions and formats, array constraints, defaults, validation constraints, and parameter serialization in operation Markdown
• make the downloadable envd OpenAPI usable through the stable sandbox proxy by publishing its server and required routing headers
• parse public protobuf structurally so nested messages, maps, oneofs, enums, comments, and field ownership are rendered accurately
• add contract regressions for leaked components, internal SDK members, schema completeness, nested sandbox fields, query-array wire formats, envd routing, and Process/Filesystem protobuf semantics

Verification

• make generate
• pnpm check:generated
• pnpm format:check
• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm check:public
• pnpm test:release
• ./scripts/build-release.sh
• node scripts/check-public-artifacts.mjs release
• ./scripts/test-release-artifacts.sh