fix(openapi-mcp): restore scoped release classification

[Adam Poulemanos (bashandbone)]

What

Correct OpenAPI MCP commit-release rules so package feature and fix commits can produce a release without admitting unrelated commits.

The unconditional { "release": false } rule matched package commits as well as unrelated commits. The installed analyzer consequently reported no release for feat(openapi-mcp) and fix(openapi-mcp).

Observed in release attempt 2: startup and OIDC verification completed, but commit analysis reported no relevant changes. No package was published and no public provenance verification occurred.

Add behavioral regression coverage using the installed commit analyzer and the package's actual manifest configuration.

The manifest is generated, so update the OpenAPI-specific generator output as well. Other packages retain their existing release rules; their inherited catch-all behavior is a separate follow-up, not silently changed by this PR.

Plugin(s) affected

• None (OpenAPI MCP release configuration and tests)

Verification

• RED: new analyzer fixtures reproduced five failures with the original rules.
• Independent review caught slash-scoped commits escaping a path-segment exclusion. New regressions reproduced that failure; whole-pattern negation now rejects those scopes before default-rule fallback.
• GREEN: final focused release suite passed 57 tests with 222 assertions.
• Full bun test: 1,048 passed, 1 existing Graph skip, 0 failed; 5,001 assertions across 40 files.
• bun run validate: marketplace checks and generated-file consistency passed.
• Biome checked all three changed files; git diff --check passed.
• Scoped independent re-review of fda132aa closed the scope-matching finding with no new findings; reviewer reran the focused suite and passed 150 additional analyzer checks.

Release boundary

No package-version override, publication, workflow rerun, deployment approval, or npm setting change is part of this PR. OPENAPI_MCP_OIDC_READY was enabled for the previous operator-authorized attempt and remains enabled. A merge can therefore reach publishing after the protected npmrelease environment is approved.

Checklist

• Conventional commit with openapi-mcp scope
• Repository validation and tests pass
• No public runtime API change
• No manually authored changelog

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T20:05:59.212218Z	fda132a	PR opened
🔒 Security Review	✅ Completed 2026-09-05T20:07:10.557419Z	fda132a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀