chore(contract): bump OpenAPI spec pin to community v9.6.1

[saurabhjain1592]

Summary

Refreshes the wire-shape contract baseline (tests/fixtures/wire_shape_baseline.json) to the current community spec revision, via the repo's own regenerator (scripts/refresh_wire_shape_baseline.py). Baseline + pin only — no SDK source changes.

Spec pin: 0bd92562 (v7.4.x era) → ac1b7cd8 (community v9.6.1, current origin/main of getaxonflow/axonflow docs/api).

Refs getaxonflow/axonflow-enterprise#2861.

Entries dropped (20) — now declared by the v9.6.1 spec

Headline: MCPCheckInputResponse — redacted / redacted_statement / redaction_evaluated (Decision Mode PEP redaction contract, #2563/#2571) are now declared by agent-api.yaml, so the acknowledged-sdk-superset entry drops out as satisfied.

Also dropped (spec now declares the previously SDK-only fields): AuditSearchRequest (decision_id/offset/override_id/policy_name), Budget (enabled), CancelPlanResponse (message), ClientRequest (media), ClientResponse (budget_info/media_analysis), CreateStaticPolicyRequest (organization_id), CreateWorkflowResponse (created_at/source), DynamicPolicy (7 fields), ExecutionSnapshot (approval fields), ExecutionSummary (input/output_summary), MarkStepCompletedRequest (metadata), PlanResponse (complexity/domain/parallel/status), PolicyEvaluationInfo (code_artifact), ResumePlanResponse (7 fields), UpdateStaticPolicyRequest (category), UsageBreakdown/UsageRecord/UsageSummary (period fields/timestamp), WorkflowStepInfo (per-step audit fields).

Baseline shrinks 28 → 9 drift entries; spec-bug-pending count drops 4 → 0.

Entries kept (9)

• MCPCheckOutputResponse — redaction_evaluated: the platform now emits it on check-output (#2865/#2866, shipped 2026-07-09), but the spec declaration rides the v9.7.0 community sync — this entry flips on the next pin bump. Note updated to say exactly that.
• MCPCheckInputRequest — content_type: still not declared by agent-api.yaml in v9.6.1 (verified); note unchanged.
• AuditLogEntry: reclassified spec-bug-pending → acknowledged-sdk-superset. The former spec-bug portion (metadata/model/policy_violations) is now spec-declared; only the Indonesia UU PDP cross-border fields data_residency/transfer_basis remain SDK-only.
• DecisionExplanation — context/context_truncated: still not declared as of v9.6.1 (the old note predicted the v8.5.0 sync; it didn't land). Note updated.
• DynamicPolicyMatch, ExfiltrationCheckInfo, PolicyOverride, PolicyVersion: deprecated-pending-removal entries, unchanged.

Entries added (1)

• DecideResponse — error (acknowledged-sdk-superset): the v9.6.1 spec newly declares DecideResponse, so the SDK model now maps. The agent's decide error envelope (sendDecideError) emits error alongside verdict=deny on malformed requests so PEP code parses a single envelope, but agent-api.yaml doesn't declare the property. Tracked in #1745.

Also newly pinned cross-spec duplicate: ConformityAssessment (agent-api vs orchestrator-api declarations diverge in v9.6.1 — platform-side spec inconsistency, shape-pinned so further drift still fails the gate).

Validation

• pytest tests/test_wire_shape.py -m wire_shape -v --no-cov with AXONFLOW_OPENAPI_SPECS_DIR pointing at a detached checkout of getaxonflow/axonflow @ ac1b7cd8: 7/7 passed (including the cross-spec divergence gate and rename-escape guard).
• Full suite pytest tests/ -x -q: 1047 passed, 29 skipped (includes test_refresh_wire_shape_baseline.py note-format gates).

The spec-pin-bump label is applied to authorize the openapi_specs_sha change per the wire-shape-contract CI guard.