[chrischeng-c4]

Closes #35

Summary of Changes

Implements the manifest provenance and runtime dependency requirements for issue #35 in crates/openapi-codegen:

• GenerationManifest Provenance & Version:
  • Added openapi_sha256: String, generator_version: String, and service_compatibility: Option<String>.
  • Bumped schema_version to 2.
  • Pinned sha2 (0.10.x, default-features = false) in crates/openapi-codegen/Cargo.toml matching workspace Cargo.lock.
• GenOptions Configuration & Validation:
  • Added with_service_compatibility(label) and getter service_compatibility().
  • Validates options before generation, rejecting empty or whitespace-only labels with typed ServiceCompatibilityError::EmptyOrWhitespace.
  • Added try_with_service_compatibility(label) helper for immediate typed validation.
• Pure GeneratedOutput In-Memory Provenance:
  • Records the hex-encoded SHA-256 of spec_json bytes and caller compatibility label on GeneratedOutput during generate / generate_for_target.
  • Computes manifest() purely from in-memory results without filesystem reads or log/spec leakage.
  • Preserves byte-identical legacy output and omits manifest when no target profile is selected.
• Runtime Dependencies:
  • Updated TypeScript target profile runtime_dependencies to include @tanstack/react-query and axios.
  • Verified full coverage of emitted third-party imports across Python (pydantic>=2), TypeScript (@tanstack/react-query, axios), and Rust (reqwest, serde, serde_json).
• Support Matrix & Roadmap Updates:
  • Moved target-dependency-manifest in crates/openapi-codegen/STATUS.md from Limited to Supported.
  • Updated complete-target-dependency-manifest in crates/openapi-codegen/ROADMAP.md.

Local Validation Results

1. Affected Isolated Unit Tests (PASSED):

   • cargo test --locked -p openapi-codegen --lib tests::output (8 passed, 0 failed):
     • materialized_output_writes_a_versioned_contract_manifest: passed
     • manifest_records_sha256_of_spec_bytes_and_detects_one_byte_change: passed (same bytes give same SHA; one-byte change gives different SHA)
     • manifest_carries_service_compatibility_label_verbatim: passed
     • rejects_empty_or_whitespace_service_compatibility_label_before_generation: passed
     • runtime_dependencies_cover_all_emitted_third_party_imports: passed (verifies all third-party imports in emitted Python, TypeScript, and Rust files are covered)
     • negative_control_removing_runtime_dependency_fails_coverage_test_naming_dependency: passed (negative control confirms coverage failure names missing dependency)
     • legacy_output_emits_no_manifest: passed
     • rejects_escaping_output_before_writing_anything: passed
   • Other affected unit test modules:
     • cargo test --locked -p openapi-codegen --lib tests::generation (7 passed)
     • cargo test --locked -p openapi-codegen --lib tests::target_profile (4 passed)

2. Negative Control:

   • tests::output::negative_control_removing_runtime_dependency_fails_coverage_test_naming_dependency explicitly removes dependencies (axios, pydantic, reqwest) and verifies the coverage checker fails with the exact missing dependency named.

3. Static Analysis & Formatting:

   • cargo fmt --check --manifest-path crates/openapi-codegen/Cargo.toml passed cleanly.
   • cargo clippy --locked -p openapi-codegen --all-targets -- -D warnings passed with 0 warnings.

Cloud CI Requirements

• Cloud MR Checks: Full package integration tests, multi-language compiler validation (tsc, py_compile), and cross-language profile matrices (tests/it/) belong in authorized cloud CI.
• Status: PENDING / NOT RUN locally awaiting authorized cloud CI on the opened PR.