Infra: harden fixture validation as the CI gate

[aqeelat]

Problem

CI previously built generated specs without running the documented OpenAPI fixture validation stage.

Expected Behavior

Fixture validation and generated spec freshness should fail CI. Generator and typecheck failures should remain report-only compatibility data.

Acceptance Criteria

• CI runs `./scripts/validate-and-build.sh`
• CI checks `git diff --exit-code -- specs/`
• README and runbook state the gating/report-only split