feat(core): implement the supervised openapi-spec-validator worker

[back1ash]

Summary

Implement the selected openapi-spec-validator 0.9.0 authority behind the versioned, supervised process boundary from ADR 0001.

Scope

• Define the worker request and response protocol over bounded standard input and output.
• Run strict JSON and YAML parsing and OpenAPI 3.0 or 3.1 structural and semantic validation.
• Use only the immutable input closure and deny external resolution.
• Normalize diagnostics with defining file, pointer, coordinates, code, severity, and truncation counts.
• Supervise timeout, process-tree termination, malformed output, dependency failure, and protocol failure.

Acceptance criteria

• The production adapter reproduces the selected spike gates across all supported platforms.
• No network request or filesystem access outside the supplied closure is required.
• Diagnostics are stable, deduplicated, sorted, and bounded.
• Known 0.9.0 exception behavior is pinned and covered by regression tests.
• Internal worker failures cannot be reported as a valid OpenAPI result.

Dependencies

• feat(core): implement repository-confined input closure and manifest #20

Priority gate and claiming

Keep status:blocked until every open priority:p0 issue is closed
and every explicit dependency above is closed. Only then replace it
with status:ready and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• Implementing Agent contract rules.
• Merging disposable spike adapters.
• Claiming the process boundary is a complete operating-system sandbox.