M44: harden release integrity and assurance

scripts/generate-openapi.py

@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+"""Regenerate the deterministic checked-in FastAPI OpenAPI contract."""
+
+from pathlib import Path
+
+import yaml
+
+from app.main import app
+
+target = Path(__file__).resolve().parents[1] / "contracts/openapi.yaml"
+target.write_text(
+    yaml.safe_dump(app.openapi(), sort_keys=False, allow_unicode=True),
+    encoding="utf-8",
+)
+print(target)