[codegen] Detect committed OpenAPI and RPC drift without rewriting outputs

[kang-heewon]

Priority

P1

Problem

Croco's OpenAPI and RPC generators cannot verify that committed outputs match source contracts without rewriting those outputs first.

Generated contract:verify scripts therefore repair stale artifacts during CI instead of proving the repository was already synchronized, hiding drift from reviewers.

Evidence

• packages/rpc-codegen/src/libs/cli.ts:55-57 uses --check only to report ContractGraph diagnostics.
• packages/rpc-codegen/src/libs/generate.ts:178-183 creates directories and writes every generated file unconditionally.
• packages/openapi-spec/src/libs/cli.ts:66-68 gives --check the same graph-only meaning, then lines 92-94 overwrite the output JSON.
• Generated admin-console, SaaS, AI-SaaS, and split-app contract:verify scripts call the writing generators.
• Closed [contracts] Add vNext contract snapshot and drift gates #823 covers ContractGraph snapshots and [presentation] Frontend action manifest와 drift gate를 제공한다 #988 covers frontend action-manifest drift; neither compares committed OpenAPI/RPC output bytes without mutation.

Desired outcome

CI can deterministically fail on stale committed OpenAPI or RPC outputs, show a readable diff/recovery command, and leave the worktree untouched.

Proposed implementation

1. Add an explicit read-only output-check mode to both CLIs without changing the current graph-diagnostic --check contract.
2. Generate expected documents/files in memory using the same production emitters.
3. Compare the complete expected file set and normalized content against disk.
4. Detect missing, changed, and unexpected stale generated files.
5. Emit stable drift diagnostics plus the exact regeneration command.
6. Update generated contract:verify scripts to run read-only checks; keep a separate codegen command for intentional writes.
7. Add a worktree/mtime guard proving check mode performs no mutation.

Acceptance criteria

• Mutating a committed OpenAPI document makes read-only verification fail.
• Mutating, deleting, or adding a stale RPC client file makes verification fail with the affected path.
• Unchanged outputs pass without changing file bytes, mtimes, or directory contents.
• Graph diagnostics and output drift remain distinguishable stable error categories.
• Generated app CI verifies before regeneration.
• The same emitters power write and check modes so serialization cannot drift.

Validation

• Run OpenAPI and RPC codegen test suites.
• Add fixtures for changed, missing, extra, and unchanged outputs.
• Run generated-app contract:verify and assert git diff --exit-code.
• pnpm create-croco-app:smoke
• pnpm check

Scope boundaries

Do not introduce a second generator implementation or require semantic API compatibility analysis here. This issue checks deterministic committed artifacts against current emitters.