[openapi-mcp S3] P3 proof: auth-guarded spec fixture + spec_unavailable wording

[rickylabs]

Part of #1126

Scope

Disposable proof [P3] — auth-guarded spec fixture: a service whose user-configured authz matcher covers /api/openapi.json; capture what the spec fetch actually returns (401/403 shape) and finalize the spec_unavailable failure-envelope wording that names the likely authz-matcher cause and the fix.

Design source: RFC #1123 (rfc.md §4 Wave 0) + .llm/runs/plan-openapi-mcp-plugin--seed/design/canonical/02-discovery.md §status mapping (rev 2).

Acceptance

• gate: committed proofs/P3-verdict.md with the fixture result and the ratified spec_unavailable wording

[rickylabs]

P3 is committed in PR #1182 at 5c041bdfd.

• Focused auth-guarded fixture: exit 0, 1 passed, 0 failed; exact 401/403 envelopes and authorized 200 observed.
• Ratified spec_unavailable wording is byte-identical to locked plan D9.
• Separate Fable review: APPROVED, including an independent fixture rerun.
• Evidence: .llm/runs/test-openapi-mcp-wave0-proofs--wave0/proofs/P3-verdict.md and proofs/evidence/P3-auth-fixture.json.

The acceptance box is now checked. This proof ratifies behavior and wording only; it does not claim the later production authenticated-spec feature exists.