chore(contract): bump OpenAPI spec pin to community v9.13.0

[saurabhjain1592]

Summary

Dedicated spec-pin bump: refresh tests/fixtures/wire-shape-baseline.json from community spec revision f910aa3d (v7.4.x era) to df027c788b60c18d044278c45aa4bce3a1ac8717, the v9.13.0 tag of getaxonflow/axonflow (docs/api) - the current platform line. Originally targeted v9.6.1 (ac1b7cd8); refreshed in place during backlog clearance so all four SDK spec-pin PRs land exactly v9.13.0.

Regenerated via scripts/wire_shape/refresh.py against a detached sparse checkout of the community repo at the v9.13.0 tag. Baseline + pin only - no changes to src/, pom.xml, or CHANGELOG.md. The pin drives only this baseline (verified: openapi_specs_sha is consumed by .github/workflows/wire-shape-contract.yml and scripts/wire_shape/* alone; the WireMock contract fixtures are SDK-side and not spec-generated).

Refs getaxonflow/axonflow-enterprise#2861.

v9.13.0 refresh results

• registered_types 79 (old pin) -> 97: the v9.13.0 spec now declares matching schemas for AuditSearchResponse, HITLApprovalRequest, HITLReviewInput, ImpactReportInput, ImpactReportRequest, ImpactReportResponse, ImpactReportResult, PolicyConflict, PolicyConflictRef, PolicyConflictResponse, SimulatePoliciesRequest, SimulatePoliciesResponse, SimulationDailyUsage, UnifiedStepStatus (plus the Decision Mode set that arrived with v9.6.1).
• per_type_drift 42 types, intra_file_duplicates 0, cross_spec_duplicates 8 - all recorded mechanically for the QF-14 burn-down.
• MCPCheckOutputResponse.redaction_evaluated is now declared by the spec, exactly as the v9.6.1 round's _note predicted ("flip this entry out on the next pin bump").

Breaking-shape review (Java SDK surface)

No breaking-shape changes for the SDK:

• Nothing dropped: zero types left registered_types; no SDK class lost its schema.
• New spec_only fields (e.g. AuditLogEntry observability fields, PolicyOverride tenancy fields, HITLApprovalRequest override fields) are additive spec declarations; the SDK's Jackson config is unknown-property tolerant and @JsonInclude(NON_NULL) on the write side.
• New sdk_only entries (e.g. AuditLogEntry.latency_ms/query_summary, UnifiedStepStatus camelCase set) are pre-existing SDK fields the reshaped spec no longer declares - read-side fields that degrade to null, recorded in the baseline for burn-down, no SDK behaviour change in this PR.

Validation

• AXONFLOW_OPENAPI_SPECS_DIR=<v9.13.0 docs/api> python3 scripts/wire_shape/validate.py -> 97 class/schema pairs validated, 0 issues (296 schemas loaded).
• mvn test (JDK 17) -> 1325 tests, 0 failures, 0 errors, 0 skipped on the rebased head (current main, incl. fix(security): bump jackson to 2.22.1 [skip-runtime-e2e] #203 jackson 2.22.1 and fix(examples): pin poms to published 9.0.0; fail loud on tenant mismatch [skip-runtime-e2e] #196).

spec-pin-bump label applied per the wire-shape-contract SHA-bump guard.

[saurabhjain1592]

Backlog-clearance verification (rebased + refreshed head 9b40790):

Refreshed in place from v9.6.1 to v9.13.0 per the coordinated four-SDK spec-pin train. tests/fixtures/wire-shape-baseline.json regenerated via scripts/wire_shape/refresh.py against a detached sparse checkout of getaxonflow/axonflow at tag v9.13.0 (df027c788b60c18d044278c45aa4bce3a1ac8717, verified git describe --tags = v9.13.0). Baseline + pin only - the diff vs main is exactly one file. The pin drives only this baseline (grep-verified: openapi_specs_sha is consumed by .github/workflows/wire-shape-contract.yml and scripts/wire_shape/* alone; WireMock contract fixtures are SDK-side, not spec-generated, so nothing else to regenerate).

Breaking-shape review: none for the Java SDK surface. registered_types 79 -> 97 with zero types dropped; new spec_only fields are additive declarations the SDK tolerates (unknown-property tolerant reads, NON_NULL writes); new sdk_only entries are pre-existing SDK fields the reshaped v9.13.0 spec no longer declares, recorded mechanically in the baseline for the QF-14 burn-down; no src/ change in this PR. MCPCheckOutputResponse.redaction_evaluated is now spec-declared, as the v9.6.1 round's _note predicted.

Validation on the rebased head (current main incl. #203, #196, #197):

• AXONFLOW_OPENAPI_SPECS_DIR=<v9.13.0 docs/api> python3 scripts/wire_shape/validate.py -> 97 class/schema pairs validated, 0 issues (296 schemas loaded).
• mvn test (JDK 17) -> 1325 tests, 0 failures, 0 errors, 0 skipped.

CI: all 17 checks green on 9b40790, including Validate Wire Shape (fetches the specs at the new pinned SHA and validates against them; the spec-pin-bump label authorizes the SHA change per the guard), Contract Integration (WireMock), real-stack ubuntu/macos/windows, CodeQL and DCO: https://github.com/getaxonflow/axonflow-sdk-java/actions/runs/30837382536 https://github.com/getaxonflow/axonflow-sdk-java/actions/runs/30837381086

Merging per backlog-clearance brief.