Per #385, vendor extensions on SOVD-standard endpoint payloads should be
nested under a single `x-medkit` object instead of flat top-level keys.
This was already the convention for most endpoints (faults, data, ops,
bulk-data, ...) but two sites still emitted flat keys:

- GET /updates/{id}/status emitted `x-medkit-phase` at the top level
- GET /apps|components/{id}/configurations emitted `x-medkit-source`
  on each item and `x-medkit-source`/`x-medkit-node` on each parameter

Both now emit a nested `x-medkit` object. The OpenAPI schemas for
UpdateStatus and ConfigurationMetaData declare the nested object
explicitly so generated clients (ros2_medkit_clients) get accurate
typing.

Adds an integration test (test_openapi_response_drift) that validates
runtime GET responses against the OpenAPI response schema served at
/api/v1/docs. The original drift slipped past every typed client because
the schema never declared `x-medkit-phase` even though the handler
emitted it; this test catches that class of regression at runtime.
The compile-time contract (template-based emitter-to-schema link) lands
later under #338.

GET /apps/{id}/is-located-on returns a single-element collection
({items, x-medkit, _links}) per the handler in discovery_handlers.cpp,
but the spec was advertising it as EntityDetail (single object with
required id/name). Aligns the spec to the actual response shape so the
new drift test passes and generated clients get the right type.

Four review points addressed:

- test_update_manager.cpp: switch j["x-medkit"]["phase"] reads to
  contains() + at(). nlohmann's operator[] on a non-const json inserts
  missing keys, which can mask a regression where update_status_to_json
  stops emitting the vendor extension.
- test_openapi_response_drift: REQUIRED_APPS = {temp_sensor, calibration}
  forces deterministic discovery before setUpClass proceeds, instead of
  relying on MIN_EXPECTED_APPS=1 catching an arbitrary first node.
- _inline_refs: raise _RefResolutionError on unresolved or cyclic $refs
  rather than returning {} (which validates anything and hides drift).
  Caught in the validation loop so multiple spec issues surface in one
  run.
- Module docstring: spell out what the validator catches (required,
  type, enum, nested shape) and what it does not (extra undeclared
  fields, since most schemas don't set additionalProperties: false).
  Closing the additionalProperties gap belongs in the issue #338 rework.

Mirror of test_update_status_payload_uses_nested_x_medkit for the
configurations endpoint. The drift test cannot catch reintroduction of
the legacy flat x-medkit-source / x-medkit-node keys because the
ConfigurationMetaData schema is not closed (no additionalProperties:
false), so an explicit positive assertion locks in the new shape.

The test exercises temp_sensor's four declared ROS 2 parameters, which
covers the per-parameter emit path migrated by this PR.

…rift test

- configuration_metadata_schema(): declare ``x-medkit.node`` alongside
  ``source``. config_handlers.cpp emits both on every per-parameter entry
  in aggregated configurations; clients generated from the spec dropped
  ``node`` because it was undeclared. Add a static schema test that fails
  if either property goes missing - the integration drift test cannot
  catch this because configuration_metadata_schema leaves
  additionalProperties open by convention.

- update_status_schema(): rewrite the comment around the inner
  ``required: {phase}`` to spell out that ``phase`` is required only when
  x-medkit is present, not unconditionally.

- test_openapi_response_drift: replace the silent ``test_entity``
  fallback in _substitute_path_params with an explicit
  _MissingEntityType exception. The loop now skips paths whose entity
  type was not discovered and reports them in test output, instead of
  hitting 404s the loop dropped without validating. Added unit tests
  for the helper.

- test_openapi_response_drift: poll /docs until at least
  MIN_EXPECTED_PATHS paths are present, so a slow plugin registration
  cannot let the test read a partial spec and silently miss endpoints
  registered after the snapshot.

- test_openapi_response_drift: clarify class docstring on GET-only
  scope; POST/PUT/DELETE coverage stays out of scope.

- ros2_subscription_executor: strengthen on_graph_change() warning to
  describe the exact deadlock surface and the symptom (hung worker, no
  log line). Runtime detection would need thread_local TLS, which is
  banned in code linked into the gateway plugin MODULE.