Introduce a versioned cross-client API contract

[oratis]

Summary

• add an OpenAPI 3.1 v1 source for the REST/SSE orchestration spine, shared errors, compatibility rules, and version header
• attach X-Lisa-API-Version: 1 centrally to every /api/*, /chat, and /events response without changing existing v1 bodies
• generate TypeScript and Swift version constants from OpenAPI, and fail CI/publish checks when generated files drift
• move the real /api/agents/sessions serializer into a pure DTO builder and validate it plus Dispatch, Island, Error, and SSE fixtures against the schema
• make Lisa Pocket accept legacy servers with no header and additive v1 responses, but reject unsupported future majors with an actionable upgrade error
• refresh .codex release baseline, iOS paths, project scale, and the new protocol boundary

Compatibility decision

This is an additive v1 governance layer, not a body-envelope migration. Existing web and native clients keep reading the same JSON. Missing headers are treated as legacy v1; same-major optional fields and unknown SSE event types are tolerated; breaking changes require a new major or versioned route.

Validation

• npm run check:api-contract
• npm run typecheck
• npm test (1483 pass, 1 environment skip, 0 fail)
• npm run build
• npm pack --dry-run --json (contract ships in the package)
• packaging/ios-companion/build.sh test (29 pass, 0 fail on iPhone 17 Pro Simulator)

Stack

Depends on #322. Review commit 296be70 only.