Retire DEFAULT_DISPATCHER_ROUTES and the stale `graphql` entry in ApiRoutesSchema (spec-major) — #3563 follow-up

[os-zhuang]

Split from #3563. Two stale spec artifacts describe a route surface that does not exist, and one of them silently underwrote a false compliance claim for months.

1. DEFAULT_DISPATCHER_ROUTES (packages/spec/src/api/dispatcher.zod.ts:141-164)

• Consumed by nothing in packages/runtime — only its own tests and api-surface.json.
• Lists /workflow and /realtime as dispatcher routes; neither dispatcher branch exists (/realtime is deliberately never advertised, http-dispatcher.ts discovery block).
• Omits eight real prefixes: /keys, /mcp, /mcp/skill, /actions, /security, /share-links, /ready, /openapi.json.
• Real-world damage already done: packages/client/CLIENT_SPEC_COMPLIANCE.md anchored a "✅ FULLY COMPLIANT" verdict on this table while 27 real routes had no SDK expression (doc retired to a tombstone in feat(client): actions surface — the SDK path to server-registered actions (#3563 PR-2) #3571).

2. graphql in ApiRoutesSchema (packages/spec/src/api/discovery.zod.ts)

The server removed GraphQL entirely (http-dispatcher.ts: "/graphql removed — GraphQL is not in the product plan (#2462 follow-on)"), but the schema still requires the key. Concrete cost today: bare tsc -p tsconfig.json in packages/client fails with

error TS2741: Property 'graphql' is missing in type '{...}' but required in type 'Record<ApiRouteType, string>'

because getRoute()'s fallback map (index.ts routeMap) sensibly does not carry a route the server deleted. The error is masked only because CI's type check runs through a different entry point.

Why one issue

Both removals are spec-major (public @objectstack/spec exports / schema fields), so they should ride the same major-version train rather than each waiting for its own. Until then, the cheap interim is a @deprecated JSDoc on DEFAULT_DISPATCHER_ROUTES pointing at the runtime route ledger (packages/runtime/src/route-ledger.ts), which is the maintained source of truth since #3569.

Proposed work

1. Now (non-breaking): @deprecated tags on both, pointing at the ledger; regenerate api-surface.json.
2. Next major: delete DEFAULT_DISPATCHER_ROUTES (+ its tests), drop graphql from ApiRoutesSchema, remove stale graphql fixtures (packages/spec/src/api/registry.test.ts:417-424, query-adapter.test.ts:147).
3. Confirm the client's bare tsc -p goes clean once graphql is gone.

Acceptance

• Deprecation tags shipped in a minor; removals staged behind the next spec major.
• api-surface.json regenerated at each step (the export-surface CI gate enforces this).
• No consumer breakage: a repo-wide grep already shows zero runtime consumers — the removal PR should re-verify.

Refs: audit doc docs/audits/2026-07-dispatcher-client-route-coverage.md §3.