feat: persist workspace state and unify database publication

[adamcavendish]

Summary

• Persist service-owned database TOML, request limits and recovery blockers in a fixed workspace; restore healthy APIs after restart without runtime registration replay.
• Replace separate register/migrate/reload calls with publish and unregister. Publish validates connection changes, drains requests, applies pending migrations within one batch timeout, and adopts interfaces and limits atomically.
• Keep operation IDs typed and opaque; preserve data/source files during unregister and keep missing registered Turso files unavailable rather than recreating them.
• Update HTTP/CLI contracts, documentation, runtime guidance, and SDK examples.
• Include the previously committed switch to the pinned openapi-nexus 0.2.3 release binary instead of building the generator from source.

Compatibility

This changes the pre-release management API: use a workspace and POST publish rather than external paths and separate registration/migration/reload calls. The CLI now requires --workspace.

No authentication, address binding restriction, filesystem watcher, distributed PostgreSQL migration lock, or durable operation queue is introduced. Migration commits are not rolled back when a later publication step fails.

Review

Reviewed lifecycle state transitions, durable configuration adoption, migration history, request/resource ownership, restart isolation, and consumer contracts against the agreed W1–W4 design.

Fixed during review:

• A definite pre-replacement persistence failure now preserves the old healthy service when no target/schema change has occurred. Uncertain replacement still fails closed.
• Restart rejects managed-directory symlinks consistently with publish, isolates the failed database, and permits publication after path repair.
• Unregistered directories without valid UTF-8 names no longer prevent workspace startup.
• Corrected documentation for history-export availability and managed-path behavior.

Added regression coverage for these cases plus unregister removal/sync failures and target-switch persistence uncertainty.

Test plan

• cargo build --locked
• cargo fmt --check
• cargo clippy --locked --all-targets -- -D warnings
• Complete scripts/check.sh on the final code
• Real Turso and PostgreSQL migration, execution, registry and HTTP contracts
• Generated TypeScript SDK calls and process restart with both backends
• Recursive OpenAPI schema SDK generation and compilation
• Runtime skill validation and git diff --check

Local tests used disposable PostgreSQL data and the downloaded openapi-nexus binary. Hosted CI and release/container verification are separate checks, not claimed by the local results.

Documentation

Updated getting-started, workspace/registry, HTTP, migration and delivery references, examples, and runtime integration guidance. Public lifecycle changes have reference documentation, a walkthrough, and recovery guidance.