fix(openapi): reference request-shape schemas for checkout and cart request bodies

[Mubeen-Fatima]

Fixes #649.

Scope per maintainer confirmation in #649: checkout + cart in one PR, same root cause.

Problem

All five REST request bodies (create_checkout, update_checkout, complete_checkout, create_cart, update_cart) referenced the full base schema, so standard OpenAPI tooling (Swagger UI, Redoc, codegen) exposed every server-assigned field as writable — 12 ucp_request: "omit" fields on checkout and 9 on cart (id, status, totals, expires_at, continue_url, …), not just checkout.id as originally filed.

readOnly: true was considered and rejected: 28 ucp_request annotations are per-operation maps (e.g. cart.id is {"create": "omit", "update": "required"}, checkout.payment is required only on complete), which a binary, operation-global readOnly cannot express.

Change

Follows the existing catalog_search.json → $defs/search_request convention (also used by ask_request in #538):

• checkout.json: add $defs/create_request, $defs/update_request, $defs/complete_request. Properties $ref the top-level definitions (#/properties/...) so descriptions stay single-sourced; the ucp_request annotations remain the source of truth.
• cart.json: add $defs/create_request, $defs/update_request alongside the existing $defs/checkout.
• rest.openapi.json: point the five request bodies at new *_request components, mirroring the catalog wiring.

Each $defs shape was verified byte-equivalent (properties + required) to the canonical derivation:

ucp-schema resolve source/schemas/shopping/checkout.json --request --op create|update|complete
ucp-schema resolve source/schemas/shopping/cart.json --request --op create|update

Verification

• ucp-schema lint source/ — 99 files, all passed
• scripts/validate_examples.py full corpus — 282 passed, 0 failed
• scripts/test_validate_examples.py — 48 passed
• pre-commit run --all-files — passed (stylelint fails locally on a missing node module, unrelated; no CSS touched)
• mkdocs build — no new warnings vs main (reference pages only render $defs via explicit macros, so schema pages are unchanged)

Notes

• The now-unreferenced checkout/cart components are left in place (the payment component was already name-only) in case downstream codegen references them by name; happy to remove them if preferred.
• fix: Transition cart.id to be omitted in update requests instead of a required field #633 transitions cart.id to omitted in update requests; if it lands first, cart.json#/$defs/update_request needs a two-line follow-up (drop id from properties/required). Current shapes reflect the annotations on main today.
• mcp.openrpc.json has the same defect (create_checkout/update_checkout/complete_checkout tool params reference the full checkout.json). Left out of scope here as filed; can follow up if wanted.

[Mubeen-Fatima]

Rebased onto main now that #633 has landed, and re-verified.

#633 changed cart.id's update annotation to the transition form (from: required → to: omit). ucp-schema resolve --request --op update still reports id as required for cart update today, so cart.json#/$defs/update_request is unchanged and remains byte-equivalent to the canonical derivation. All five shapes re-checked against the resolver after the rebase — still matching.

Re-ran on the rebased branch: ucp-schema lint 99 files passed, example corpus 282 passed / 0 failed, validator unit tests 48 passed.

Worth flagging for whoever picks up the transition follow-up: when cart.id completes its move to omit on update, the only change needed here is dropping id from properties and required in cart.json#/$defs/update_request — the OpenAPI wiring stays as-is.