build(openapi): make governance reproducible Pin Spectral and its dependency graph, disable npm lifecycle scripts, and generate the contract against the managed PostgreSQL service. Add a guarded one-time baseline bootstrap while keeping ordinary compatibility checks fail-closed.