Complete adoption and accessibility hardening

[lightsofapollo]

Summary

Completes the repository's adoption and accessibility hardening program.

• repairs the canonical [generator.types] configuration contract, strict validation, migration guidance, and config-relative paths;
• makes cargo install --locked openapi-to-rust install exactly one versioned CLI with a lean reqwest 0.12 dependency tree;
• emits deterministic, feature-aware REQUIRED_DEPS.toml fragments for types, clients, SSE, retry/tracing, Axum servers, and typed scalars;
• adds selective client operation generation and transitive client/server reachability pruning;
• adds safe request defaults, required-field constructors, fluent setters, and opt-in additive operation builders;
• makes generated Axum query extraction symmetric with client serialization, including a live client/router round-trip;
• adds direct local/HTTPS generation, init, --dry-run, --check, --quiet, JSON output, source provenance, and bounded remote fetching;
• corrects README, changelog, CI/release, MSRV, corpus, conformance, and public tracker claims;
• adds contributor, support, security, conduct, issue-form, PR-template, crate-doc, and discovery scaffolding.

Why

The generator had several adoption cliffs: documented configuration could be ignored, source installation exposed internal binaries and duplicate dependency stacks, generated projects required dependency guesswork, large request APIs were awkward to construct, server query handling could not decode client-emitted shapes, and the quickest path required a hand-written TOML file.

This change makes the source-install workflow reliable and keeps cargo install as the primary Rust distribution path. It does not publish a crate release or add prebuilt binaries.

Compatibility and developer impact

• The declared MSRV is now Rust 1.88, matching language features actually used by the crate.
• [generator.types] is canonical. Legacy top-level [types] remains a temporary alias; specifying both is rejected.
• Unknown keys in fixed configuration sections now fail instead of being silently ignored.
• Existing flat client methods remain available; operation builders are opt-in and additive.
• Request-model constructors/defaults/setters are dependency-free additions.
• Server/client query behavior is corrected to the OpenAPI wire contract. Regenerated signatures may change where the old output represented structured query data as opaque strings.
• Selective client generation is opt-in; absence of [client] preserves generate-all behavior.
• Generated dependency fragments are advisory/copyable and never modify a consumer's Cargo.toml.
• ByteStrategy::Base64UrlUnpadded supersedes the conflicted implementation from feat(types): ByteStrategy::Base64UrlUnpadded for RFC 7515 alphabets #21.

Closes #6.

Validation

• cargo fmt --check
• issue-form YAML validation and actionlint
• cargo clippy --all-features -- -D warnings
• cargo test --all-features
• RUSTDOCFLAGS=-Dwarnings cargo doc --no-deps --all-features
• cargo +1.88.0 check --all-targets --all-features
• packaged-crate install smoke: one executable, working --version, minimal generation, no reqwest 0.11/test-only dependency leakage
• immutable conformance report checks
• OpenAI and Anthropic exact-dependency generated-code compiles
• full isolated corpus: 54 generated and 54 compiled, zero failures, one documented Swagger 2.0 skip

Follow-ups

The intentionally bounded newcomer tasks remain separate as #29, #30, and #31. Broader discriminator and server-conformance trackers were audited and left open where acceptance criteria are not yet complete.