fix(ci): generate OpenAPI spec from the release commit in sync-version

[Siumauricio]

Follow-up to #4984. The cli/sdk sync steps copied the repo-root openapi.json, which was last committed in March (450 paths vs 546 in the current API), and the mcp step fetched docs.dokploy.com/openapi.json, which any canary push can overwrite with unreleased API.

sync-version now runs pnpm generate:openapi on the release commit checkout and feeds that spec to all three repos, so each package release matches the API of its dokploy tag.

Greptile Summary

The PR generates OpenAPI from the checked-out release commit and reuses that artifact while synchronizing the MCP, CLI, and SDK repositories.

• Adds Node setup and release-checkout OpenAPI generation to the sync-version job.
• Replaces MCP's remote specification fetch with the locally generated specification.
• Keeps all downstream package generation aligned with the API represented by the Dokploy release tag.

Confidence Score: 4/5

The PR appears safe to merge, with one non-blocking supply-chain hardening issue in the newly added release-workflow action reference.

The OpenAPI generation and downstream copy paths are internally consistent, but the new mutable setup-node reference adds avoidable third-party code exposure before the job uses credentials for three repositories.

Files Needing Attention: .github/workflows/dokploy.yml

_{Reviews (1): Last reviewed commit: "fix(ci): generate OpenAPI spec from the ..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[greptile-apps]

Mutable release action reference

If the actions/setup-node@v4 tag is repointed, the release job executes changed third-party code before using DOCS_SYNC_TOKEN to access three downstream repositories, exposing credentials and generated artifacts to tampering. Pin this action to an immutable commit SHA. How this was verified: The new action runs before the authenticated MCP, CLI, and SDK clone steps in the same job.