feat(gateway,adapters): /publish endpoint (ADR-068) + to_openapi 6-endpoint projection

gateway-publish:
- GatewayDispatch::invoke_sink (internal:false, forwarded_for:None)
- POST /publish: NDJSON body, first line {operation, chunk} (OQ-02
  resolved: first-line convention; terminal errors = plain HTTP status
  + JSON body, not NDJSON lines); 404 internal/unknown, 401/403 ACL,
  400 INVALID_OPERATION_TYPE for non-Pub
- ADR-068 + open-questions.md updated with the OQ-02 resolution

adapter-to-openapi:
- src/adapters/openapi_spec.rs: OpenAPISpec model (JSON/YAML/from_str
  JSON-first per ADR-051, $ref resolution) shared by from/to_openapi
- src/adapters/to_openapi.rs: 6-endpoint projection, info.version
  1.0.0 -> 1.1.0 (minor: /publish addition per ADR-045), /publish
  NDJSON doc with 400 oneOf (INVALID_INPUT + INVALID_OPERATION_TYPE),
  ADR-023 error fidelity (protocol statuses, HTTP_<status> passthrough,
  internal-op exclusion)
- GET /openapi.json wired into HttpAdapter's router (bearer-auth layer)

Verified: cargo test (136 lib), test --all-features (136+10 WS),
clippy -D warnings (both), fmt. Doc validates against openapiv3.

docs/architecture/decisions/068-gateway-publish-endpoint.md

@@ -45,11 +45,11 @@ stream; the operation's final `ResponseEnvelope` is the HTTP response.
 - Auth: `Authorization: Bearer <token>` — same as every gateway
   endpoint ([ADR-004](004-auth-as-shared-core.md)).
 - The target operation is named the same way as `/call` — the body's
-  first line (or a `?operation=` query parameter) carries
-  `{ "operation": "/{service}/{op}", "chunk": {...} }` for the first
-  chunk, with subsequent lines carrying `chunk` values only; see OQ-02
-  for the exact first-line convention before the gateway-spec version
-  bumps.
+  first line carries `{ "operation": "/{service}/{op}", "chunk": {...}`
+  for the first chunk, with subsequent lines carrying `chunk` values
+  only. (OQ-02 resolved: first-line convention, no query parameter, no
+  header; a `?operation=` parameter was rejected because it duplicates
+  the first-line field and complicates curl one-liners for no gain.)
 
 ### Dispatch
 
@@ -114,8 +114,10 @@ the doc does not preload operations.
   indistinguishable from a network error to the server side (the
   handler sees EOF either way). Callers needing explicit failure
   semantics use the call protocol (WS channel 0).
-- OQ-02 (first-line operation-naming convention) must settle before
-  the `/openapi.json` version bumps.
+- ~~OQ-02 (first-line operation-naming convention) must settle before
+  the `/openapi.json` version bumps~~ — settled: first-line
+  `{operation, chunk}` convention; terminal errors are plain HTTP
+  status + JSON body (not an NDJSON line).
 
 ## References