feat(api-contract): enforce OpenAPI lint and client drift in CI

Extends contract enforcement beyond spec generation drift to include OpenAPI linting and frontend generated-client drift verification.

Decision: keep policy checks in CI so contract integrity is enforced consistently across contributors and environments.

Author: gildesmarais

.github/workflows/ci.yml

@@ -56,9 +56,17 @@ jobs:
           ruby-version-file: ".tool-versions"
           bundler-cache: true
 
+      - name: Setup Node.js for OpenAPI lint tooling
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".tool-versions"
+
       - name: Verify generated OpenAPI is up to date
         run: bundle exec rake openapi:verify
 
+      - name: Lint OpenAPI contract
+        run: make openapi-lint
+
   frontend:
     runs-on: ubuntu-latest
     defaults:
@@ -77,6 +85,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Verify generated OpenAPI client is up to date
+        run: npm run openapi:verify
+
       - name: Check formatting
         run: npm run format:check