fix(api): keep public and sandbox wire contracts distinct

[rschlaefli]

What This Maintains

Re-derivation of the contract-maintenance package from #21 on the current
main (929ec4d, upstream v1.2.0 retained). It keeps CodeAPI's OpenAPI
documents and TypeScript names aligned with behavior that already exists:

1. Documents the public /v1 execution and file-management routes and their
   current wire shapes in service/openapi.yml.
2. Keeps api/openapi.yaml explicitly internal to /api/v2/execute.
3. Preserves the exported ExecuteResponse sandbox transport and introduces
   PublicExecuteResponse for the existing flat public execution result.
4. Adds focused contract tests for route inventories, local references,
   schema boundaries, response codes, and TypeScript relationships.

This package is runtime-neutral. No UZH feature, source gate, image, or
deployment depends on it, and rollback is an ordinary source revert.

Why a Re-Derivation

#21 branched from 83c4f7b and no longer applies to main. Since then the
fork merged upstream v1.1.0 and v1.2.0, which added the hosted-apps routes, a
public timeout request field, and four more ledger rows. Rebasing the old
branch would desynchronize the documents from current sources, so this branch
reapplies the same intent over the current tree instead.

How It Works

• service/openapi.yml describes the nine stable public routes mounted at
  /v1, including the newer /hosted-apps and /hosted-apps/{app_id} paths.
• api/openapi.yaml is explicitly internal (x-internal: true) and describes
  only /api/v2/execute.
• PublicExecuteResponse aliases the existing flat ExecuteResult; only
  proven internal type sites that consume that shape use the clearer name.
• The legacy ExecuteResponse export remains unchanged for the sandbox
  adapter and any unindexed downstream source consumer.
• service/src/openapi-contract.test.ts asserts local $ref resolution, the
  public route set, the public/internal schema split, the flat result type
  relationship, and the rate-limit and timeout response surfaces.

Important Details

• The hosted-app routes legitimately carry no 429, so the rate-limit
  assertion is an explicit rate-limited route list rather than a blanket
  check over every path.
• Unknown public request properties remain runtime-tolerated; the documents
  describe supported fields only.
• This branch contains no runtime response change, dependency, lockfile,
  authentication, logging-policy, database, deployment, image, or telemetry
  change. It is contract maintenance only.
• Carries main's newer ledger rows (JWT trust, values-free logs, telemetry
  preservation, no-fork-release policy) alongside the new public-contract row.

Branch Coverage

• Base: main@929ec4d8220f969a3f049e3a134259befeed15d7
• Head: 43ed62c
• Changed: 8 files, +1045/-205; no dependency, lockfile, generated-output,
  runtime, or deployment delta.

Verification

• bun test in api/: 481 pass, 0 fail.
• bun test in service/: 1091 pass, 12 redis-dependent skips, 0 fail.
• bun run build in service/: success.
• service/src/openapi-contract.test.ts: 6 pass, 181 assertions.
• Branch CI runs on push; results are recorded in the checks below.

Supersedes #21, which stays open for reference until a disposition is approved.