chore: refresh API-key constraints and Castiron reporting

[jbeckwith-oai]

Record that project API-key updates require scopes, an expiration, or both using required-only anyOf, while preserving published CLI behavior.

This regeneration also updates shared Castiron CI/reporting helpers: required main checks take precedence when main and next PRs share a head, and checkpoint verification recognizes the versioned next-target envelope and namespaced checkpoint refs. Invalid envelopes and ambiguous same-target PRs still fail closed. The strict generated-ownership policy remains at zero custom lines.

Validation: trusted public-main ownership and custom-code budget checks pass (0/0); the shared reporting suite passes 99 tests with one skip; two independent review rounds are clean. Current-head CI is running. SDK CODEOWNER approval is required for the schema, generated tooling, and workflow changes.

[github-actions]

Castiron custom code

Evaluated main: 7639dab16a033ef6335cbb386b990b2ff6098d80.

Trusted main policy: 7639dab16a033ef6335cbb386b990b2ff6098d80.

✅ No new custom-code files detected.

0 mixed files remain; 0 existing customizations changed.

Compared 7639dab16a03 → 26fd0998768a. Generated baselines verified.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 39374392822 --repo openai/openai-cli \
  --name castiron-custom-code-39374392822-1 --dir /tmp/castiron-custom-code-39374392822-1
git apply --stat /tmp/castiron-custom-code-39374392822-1/custom-code.patch
cat /tmp/castiron-custom-code-39374392822-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 7639dab16a033ef6335cbb386b990b2ff6098d80 26fd0998768a9a7251800803b2a83a0e9a3c29b5
python3 scripts/castiron/custom_code_report.py report \
  --base 7639dab16a033ef6335cbb386b990b2ff6098d80 \
  --head 26fd0998768a9a7251800803b2a83a0e9a3c29b5 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-26fd0998768a
cat /tmp/castiron-custom-code-26fd0998768a/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[markstuart-oai]

Reviewed 26fd099. No blocking findings.

The schema requires scopes, an expiry, or both. The other removed schema properties were already excluded from CLI generation. No Go sources or dependencies change. The reporting updates preserve strict generated ownership, the zero budget, checkpoint validation, and explicit workflow associations while resolving same-head fallback discovery in favor of main.

Current hosted checks are successful or skipped. I reviewed source and hosted CI; I did not run tests or builds locally.