feat: lint:spec command + changelog generation (Phase 3 hub side)

[dean-harel-unipaas]

The hub-side half of the gates/changelog work: it owns the lint command and generates the changelog.

lint:spec is now the single-source lint command

"lint:spec": "spectral lint --ruleset .spectral.yaml --fail-severity error", called as npm run lint:spec -- <file>. The ruleset, the Spectral engine/version, and the severity all live here, so the producer's pre-merge gate (next) just runs this command rather than pinning its own Spectral. Errors fail; warnings don't.

Changelog on publish

publish.ts diffs the previous published spec against the incoming one (oasdiff changelog ... -f markdown) and prepends a ## <tag> (<date>) entry to CHANGELOG.md, also folding the diff into the release notes. Best-effort: if oasdiff is absent or errors, it falls back to a neutral note rather than failing the publish. CHANGELOG.md is reset to a clean header so entries prepend cleanly (newest on top).

Verification

• npm run typecheck clean, npm test 11/11, npm run lint:spec -- spec/openapi.json runs (no crash).
• Prepend format verified (header fixed on top, newest entry first).
• The real oasdiff diff populates once it's installed in the producer's publish job (the remaining producer-side bit); until then entries read "No API-surface changes detected." / "Initial published spec."