[openapi-mcp S7] Endpoint-manifest emission from the P1-proven seam

[rickylabs]

Part of #1126

Scope

Endpoint-manifest emission wired into the generated Aspire surface using the exact seam S1 proved — post-allocation callback writing .netscript/run/endpoints.json (atomic temp+rename, temp cleanup, byte-idempotent, gitignored; schemaVersion, projectRoot, runId, literal-loopback URLs).

Blocked by S1: do not start before proofs/P1-verdict.md exists. A FAIL verdict there re-scopes this slice to the aspire-cli adapter path (F1(b)) — in that case this issue covers the CLI-query adapter's spawn/parse/failure-state handling instead of template emission.

P1 resolved to qualified F1(b). PR #1206 implements the re-scoped CLI-query adapter path; no template manifest is emitted.

Design source: RFC #1123 (rfc.md §2.3) + design/canonical/02-discovery.md §producer (rev 2).

Acceptance

• gate: scaffold.runtime evidence — a scaffolded app run produces the manifest (or CLI-adapter equivalent) and list_api_services resolves live ports through it. Evidence: feat(mcp): harden Aspire CLI endpoint discovery #1206 (comment) (fresh randomized-port scaffold, live AppHost: aspire describe proxy 45889 / allocated target PORT=45253; list_api_services resolves users via aspire-cli at 127.0.0.1:45253 with 3 operations; foreign AppHost live throughout — identity binding held; S3 negative case preserved)