openapi.json lives here, committed. CI enforces it matches the code.