test(daemon): pin the complete REST path surface and the /v1/runs absence

[KnockOutEZ]

Closes #481.

Problem

tests/unit/daemon/rest-openapi.test.ts pinned only positive paths — "is /v1/search defined?" — which is existential and cannot see a path nobody asked about. Spec §10(d) asked for a REST regression golden after the rest/runs*.ts removal; without one, a reintroduced /v1/runs route passes green.

Change

Test-only. No route changes, no source change.

• GOLDEN_REST_PATHS — the complete served path surface, sorted, hand-maintained (13 paths: 10 tools + /v1/tools + both openapi aliases).
• assertExhaustivePathSurface() — Object.keys(doc.paths).sort() deep-equals the golden. Any added or removed route reds it.
• assertNoRunSurface() — the second, independent assert: it filters the LIVE path list for /v1/runs*, never the golden array, so editing the golden cannot silence it. It also runs over the golden array itself, so a careless paste is caught at review too.
• Two fixture rows prove each pin can actually fail, over copied key lists (buildOpenApi() is memoized and shared — the served document is never mutated).

Demo

Mutant A — a real /v1/runs route reintroduced in buildPaths():

 FAIL  tests/unit/daemon/rest-openapi.test.ts > pins the COMPLETE sorted path surface — an added route must be declared in the golden
AssertionError: expected [ '/openapi.json', '/v1/agent', …(12) ] to deeply equal [ '/openapi.json', '/v1/agent', …(11) ]
 FAIL  tests/unit/daemon/rest-openapi.test.ts > documents no /v1/runs* path — the run surface is not core's any more
AssertionError: expected [ '/v1/runs' ] to deeply equal []
      Tests  2 failed | 17 passed (19)

Mutant B — the acceptance criterion: mutant A still in place, plus /v1/runs pasted carelessly into GOLDEN_REST_PATHS. The exhaustive row goes green; the negative stays red:

 FAIL  tests/unit/daemon/rest-openapi.test.ts > documents no /v1/runs* path — the run surface is not core's any more
      Tests  1 failed | 18 passed (19)

Both mutants reverted by reverse-edit; git diff touches the test file only.

Gates (local — CI deferred, quota)

npx vitest run tests/unit/daemon/rest-openapi.test.ts   Tests 19 passed (19)
npm run build                                           exit 0
npm test        Test Files 958 passed | 5 skipped (963)
                Tests 11828 passed | 20 skipped | 7 todo (11855)
npx tsc --noEmit                                        exit 0
npm run typecheck:studio                                exit 0
npm run gate:studio                                     exit 0

CI deferred — quota.