ci: fail closed on API compatibility checks

[ryanduguid]

Summary

• always fail when oasdiff reports a breaking change, instead of trusting a contributor-controlled commit marker to waive the check
• fail when the base cannot be refreshed or when changelog generation fails
• pin the oasdiff container by version and multi-platform digest
• document the immutable default and the tag-plus-digest update procedure
• reduce workflow permissions to read-only, pin checkout, and bound runtime
• replace the old commit-message tests with pass, breaking-change, tool-error and invalid-argument behaviour tests

Validation

• bash -n scripts/api-diff/api-diff.sh scripts/api-diff/api-diff.test.sh
• bash scripts/api-diff/api-diff.test.sh
• actionlint .github/workflows/api-diff.yml
• git diff --check

Pin provenance was checked against the upstream oasdiff v1.28.0 release and the publisher's Docker registry manifest. The tufin/oasdiff:v1.28.0 multi-platform manifest resolved to sha256:86830f988eaafcf589acb2794ee5ab78e3300ded071d6517bf085469300cbf36, matching the workflow default.

Docker is unavailable in the local Windows environment, so the local test suite uses a deterministic fake Docker command to exercise each exit path. Trusted Codegen Repo Validation passed on exact head 3311e7b in 4m32s (run 31624823983).