feat(connector-openapi): declarative provider — resolve providerConfig.spec from a file path (ADR-0096 follow-up)

[os-zhuang]

Follow-up to #2977 / ADR-0096. Deferred enhancement identified while implementing the declarative provider factories (#2994).

Context

ADR-0096's canonical example authors an OpenAPI-backed instance as:

connectors: [{
  name: 'billing',
  provider: 'openapi',
  providerConfig: { spec: './billing-openapi.json', baseUrl: 'https://billing.example.com' },
  auth: { type: 'bearer', credentialRef: 'billing_api_token' },
}]

The landed openapi provider factory materializes handlers from an inline spec object. It does not yet resolve providerConfig.spec given as a file path ('./billing-openapi.json') — reading and parsing the document from disk, relative to the owning stack/package root, at materialization time.

Ask

• Support providerConfig.spec: string as a path resolved relative to the stack/package that declares the connector (mirror how other metadata file references resolve).
• Read + parse the OpenAPI document during boot reconcile. Missing file / unparseable spec ⇒ fatal at boot, soft on reload — same policy as the rest of the ADR-0096 reconcile (materializeDeclaredConnectors, feat(automation): ADR-0096 follow-ups — runtime re-materialization + connector origin (#2977) #3001).
• Keep inline spec objects working (union: inline object | file path | remote URL).
• Guard path traversal: confine reads to the package root; reject absolute / ..-escaping paths.
• Tests: file-path happy path, missing file (fatal at boot / skipped on reload), traversal rejection.

Refs

• ADR-0096 (docs/adr/0096-declarative-connector-instances.md), ADR-0023 (OpenAPI generator)
• feat(connectors): ADR-0096 — provider-bound declarative connector instances (#2977) #2994 (declarative provider factories), feat(automation): ADR-0096 follow-ups — runtime re-materialization + connector origin (#2977) #3001 (runtime reconcile)