[openapi-mcp S5] ServiceEndpointDirectoryPort + source adapters (identity, outcomes, precedence)

[rickylabs]

Part of #1126

Scope

ServiceEndpointDirectoryPort + adapters (run-manifest / appsettings / override / aspire-cli on the named EndpointSource axis): identity binding — manifest eligible only when projectRoot real-path matches and runId is current; service self-identification cross-check before any entry reports running (S-8); per-source outcomes used/absent/failed(reason) surfaced to tools — a failed read is never rendered like a healthy absence (S-9); deterministic precedence override > aspire-cli > run-manifest > appsettings with visible per-service conflict (S-10); bounded fetches — timeout, abort, per-service isolation, concurrency cap (S-11); one status mapping: not_running / spec_unavailable / identity_mismatch / excluded (S-12); introspection.excludeServices honored — excluded services never fetched (S-25).

Blocked by S1: do not start before proofs/P1-verdict.md exists. A FAIL verdict there is legitimate and switches the primary live source to the aspire-cli adapter (F1(b)) — same port contract, different default adapter.

Design source: RFC #1123 (rfc.md §2.3) + design/canonical/02-discovery.md (rev 2).

Acceptance

• gate: fixture matrix covers every source outcome and status-mapping row, incl. foreign-root manifest, torn/invalid manifest with healthy appsettings, and identity mismatch on a reused port
• gate: one hanging spec endpoint yields a row-level timeout while the rest of the directory returns