Embed the OpenAPI spec (or its hash) for provenance #2

From the SDK review 2026-09-15.

Evidence: only goadserver-go embeds api/openapi.yaml (10514 lines). For this repo, which spec revision generated it is only provable via commit messages — all 4 SDKs do share generator 7.21.0 and identical history, but that is convention, not evidence.

Fix: embed openapi.yaml here too, or at minimum stamp the spec hash + generator version into the README on each regeneration.