ci: warn-only OpenAPI spec drift check

Adds an OpenAPI generation step to the Security & Quality workflow
that flags drift between the Zod registry and the committed
docs/api/openapi.yaml. Runs with continue-on-error: true so v1.4.23
informs without blocking; v1.4.24+ flips it to a hard gate once the
registry has caught up with the legacy hand-maintained spec.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/security.yml

@@ -41,6 +41,24 @@ jobs:
       - name: Unit tests
         run: pnpm test
 
+      # v1.4.23 W4 F5c — OpenAPI spec drift check.
+      #
+      # `continue-on-error: true` is intentional for v1.4.23: the
+      # registry covers only the iOS-touched routes today, and the
+      # legacy hand-maintained spec at docs/api/openapi-v1422-legacy.yaml
+      # carries the rest. Once the registry hits ~95% coverage in
+      # v1.4.24+, flip this to a hard gate by removing
+      # `continue-on-error`.
+      - name: OpenAPI spec drift check
+        continue-on-error: true
+        run: |
+          pnpm openapi:generate
+          if ! git diff --exit-code docs/api/openapi.yaml; then
+            echo "::warning::OpenAPI spec out of date. Run 'pnpm openapi:generate' locally and commit the changes."
+            exit 1
+          fi
+          echo "::notice::OpenAPI spec in sync with Zod source schemas."
+
   dependency-audit:
     name: Dependency Audit
     runs-on: ubuntu-latest