Add generated Go management API client

[JAORMX]

Summary

• ToolHive's management API is consumed through generated bindings in other runtimes, but Go consumers previously had no dependency-light, typed equivalent and had to import the full application module.
• Add a nested sdk/go module containing a complete Go client generated from the canonical OpenAPI contract, with all 77 documented operations, caller-provided transport support, and safe default URL, timeout, and response-size handling.
• Make OpenAPI generation normalize stable operation/type names, correct invalid request-body schemas, and regenerate the SDK through task docs; add SDK verification, test, lint, and PR/main CI gates.

Type of change

• New feature
• Bug fix
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

Additional verification completed:

• task docs
• task docs-verify
• task test-openapi-normalize
• task sdk-test
• task sdk-lint
• task sdk-verify
• task license-check
• git diff --check

task test exercised the SDK tests successfully but did not complete cleanly in the isolated environment because unrelated race-enabled vMCP tests were reported as flaky/data-racy in an earlier run; CI should be the final root-suite authority.

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Changes

File	Change
sdk/go/	Add the nested module, complete generated API client, safe constructor, tests, and example.
cmd/help/openapi-normalize/	Normalize canonical generated OpenAPI for stable SDK generation.
cmd/help/ogen-client-wrapper/	Produce the safe public client constructor without hand-editing generated output.
Taskfile.yml	Make documentation and SDK generation a single reproducible workflow.
.github/workflows/	Verify generated SDK artifacts and test/lint the nested module on PRs and main.
docs/server/, pkg/api/v1/registry.go	Keep the published OpenAPI contract accurate for complete generated bindings.

Does this introduce a user-facing change?

Yes. Go developers can import a typed ToolHive management API client without bringing in ToolHive's application/runtime dependency graph. SDK release-tag automation is intentionally deferred; consumers must pin a compatible revision until a separately approved SDK release process is added.

Implementation plan

Approved implementation plan

1. Use the existing canonical OpenAPI contract as the single source for a complete Go client, rather than hand-maintained endpoint DTOs.
2. Add a separately consumable nested module at github.com/stacklok/toolhive/sdk/go.
3. Stabilize OpenAPI operation and schema naming, request-body representations, and generated-artifact verification before exposing the generated SDK.
4. Generate the whole documented contract, with no operation filtering; retain caller-configured HTTP/auth transport support.
5. Add deterministic generation, SDK tests/lint, public docs/example, and CI gates. Defer independent SDK release/tag automation to a follow-up.

Special notes for reviewers

• Generated client and OpenAPI snapshot account for most of the line count; the SDK covers all 77 current OpenAPI operations.
• AddRegistry remains generated for complete contract compatibility but accurately reflects the server's current 501 Not Implemented behavior.
• The public client.NewClient applies a 30-second deadline when a request has none and enforces a 10 MiB response limit. NewUnsafeClient is explicitly documented for callers that supply an equivalent policy, such as streaming scenarios.

Generated with Claude Code

[jhrozek]

Automated review focused on the hand-written surface (the SDK client wrapper, codegen tooling, and CI/Taskfile wiring) — the ~104k lines of generated ogen output were not line-reviewed. One confirmed blocker: the new sdk-go CI gate has an invalid workflow reference on both run-on-pr.yml and run-on-main.yml, so it won't actually run. A few non-blocking suggestions below.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.97%. Comparing base (2bb9996) to head (4537c04).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6637      +/-   ##
==========================================
- Coverage   78.97%   78.97%   -0.01%     
==========================================
  Files         782      782              
  Lines       78015    78015              
==========================================
- Hits        61612    61610       -2     
- Misses      16398    16400       +2     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jhrozek]

Re-checked the CHANGES_REQUESTED findings against 721ebed — all 6 code-fix items are addressed correctly (workflow refs, nil-check on doc comment, WithMaxResponseBodyBytes, drain rationale, lint rationale), and the verify.sh tmpdir cleanup suggestion was consciously declined with a documented reason. LGTM.