v0.1.0

The first release, and what Phase 1 set out to prove: an OpenAPI
contract becomes routes and controllers, and nothing at runtime ever opens a specification.

Added

• Contract-driven routing. The service provider registers the routes spec:build emitted, by loading one generated
  PHP file. It reads no specification, at boot or ever.
• spec:build, which resolves the contract and emits the routes plus one controller per operation. It plans every
  file in memory before writing any of them, so a document it refuses leaves the working tree exactly as it was.
• spec:make, the only command that creates a class you own, in three forms: one named operation, a whole --tag,
  or --all. It never overwrites a file that exists.
• spec:doctor, which reports what this package will and will not honor in your contract, plus the routing table
  that results. Read-only, with --json for CI and tooling.
• The two-class seam. Generated controllers are abstract and yours extend them, so a contract change becomes a
  static analysis error rather than a runtime surprise. An operation nobody has implemented answers 501 and names the
  command that implements it.
• Remote reference vendoring. spec:build --update-refs fetches an allowed reference once and commits the copy.
  Every other command reads the working tree and never the network.
• OpenAPI 3.0 and 3.1, read through one version strategy per minor and pinned by a conformance suite that writes the
  same contract in both and requires them to normalize identically.
• Lifecycle and security reporting. deprecated: true requires an x-sunset, and an operation declaring security
  is reported rather than enforced, in those words, because the route is registered with no authorization check behind
  it.

Known limits

Not a Keep a Changelog section. It is here because a release that ships a gap on purpose owes it a line, and none of the
six standard sections says "this works, up to here".

• security is reported, not enforced. A contract declaring it exits 2 on every doctor run until enforcement
  lands. See security.md.
• Four configuration blocks are inert, and each names the phase that makes it live. Changing one has no effect
  today.
• No response DTOs, no generated validation, no pagination or rate limiting. All of it is
  Phase 2.