Re-vendor the gateway-config schema artifact and validator bundle

[pareilly]

Why

The vendored schema artifact predated the session-control work in the product repo, so dtwo-gateway-config documented client_id as required and knew nothing of redirect_uri.

That is backwards for the common case. On a gateway authenticating against Dtwo's own IdP the platform provisions the ceremony application per organization and the deploy renders its client id, so the field should be left unset; only a gateway trusting a customer-run IdP needs to set one. The skill was telling every user to go register an application and paste an id — the one thing a Dtwo-authenticated gateway should not do.

Both files, one revision

The artifact and skill-harness/vendor/config-validator.bundle.mjs are refreshed together from the same product-repo revision. Refreshing the artifact alone would have reintroduced the bundle/artifact drift defect closed in #34: session_control.redirect_uri would be strict-rejected by the older bundle while documented in the artifact, and SESSION_CONTROL_REDIRECT_URI would be newly reserved in the artifact but accepted inside gateway.advanced by the bundle — the same shape as the original divergences.

All three pins are bumped: artifact sha, bundle sha, and bundle version 2.0.0 → 3.0.0. The version move is a content/behaviour bump, not a structural one — the bundle's .d.mts surface is byte-identical, so the harness's shape assumptions still hold.

What the digest now says

• client_id — required yes → no, with guidance to leave it unset under Dtwo authentication and set it only for a customer-run IdP.
• redirect_uri — new field, with the derivation it overrides and the root-path constraint.
• SESSION_CONTROL_REDIRECT_URI — now listed among the keys reserved from gateway.advanced.
• Two new cross-field constraints: a non-Dtwo IdP must set client_id (the deploy fails rather than arming a ceremony with no application), and redirect_uri replaces the callback otherwise derived from the first jwt_audience entry.

Generator change

scripts/generate-schema-digest.mjs gains two fields in the OAuth variant's fieldOrder: token_endpoint_auth_method and omit_resource. Both are user-audience in the artifact, so assertDigestCoverage failed the regeneration until they were rendered — the gate working as intended.

Incidental catch-up

Carried by the refresh rather than authored here: the CGNAT / 100.64.0.0/10 note on gateway.ssrf.allowed_networks, and five newly platform-managed reserved keys.

Verification

• node scripts/generate-schema-digest.mjs --check — in sync
• pnpm test in skill-harness — 177 pass, 0 fail
• pnpm biome:check — clean

🤖 Generated with Claude Code

[pareilly]

Folded into #40 — same theme, no file overlap, and #40 already carries the plugin.json version bump this would otherwise have needed separately. The commit is cherry-picked there unchanged.