openapi: agent/pending-actions routes missing from spec, unlike their agent/audit-feed neighbor

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

⚠️ Required pattern: mirror how GET /v1/repos/{owner}/{repo}/gate-config/effective is documented
in src/openapi/spec.ts — issue #6611 fixed the exact same class of gap for that route.

Context

src/api/routes.ts exposes the agent approval-queue routes under
/v1/repos/:owner/:repo/agent/pending-actions:

• GET /v1/repos/:owner/:repo/agent/pending-actions → loopover_list_pending_actions
  (outputSchema: listPendingActionsOutputSchema)
• POST /v1/repos/:owner/:repo/agent/pending-actions → loopover_propose_action
  (outputSchema: proposeActionOutputSchema)
• POST /v1/repos/:owner/:repo/agent/pending-actions/:id/:decision → loopover_decide_pending_action
  (outputSchema: decidePendingActionOutputSchema)

None of the three appears in src/openapi/spec.ts — grep for pending-actions in that file returns
nothing, even though the neighboring /v1/repos/{owner}/{repo}/agent/audit-feed route (same
agent/* prefix, same auth class) IS documented.

Requirements

• In src/openapi/schemas.ts, define ListPendingActionsResponseSchema,
  ProposeActionResponseSchema, and DecidePendingActionResponseSchema as z.object({...})
  schemas, using listPendingActionsOutputSchema, proposeActionOutputSchema, and
  decidePendingActionOutputSchema (the raw Zod shapes already validated in src/mcp/server.ts) as
  the field-level source of truth. Add request-body schemas for the two POST verbs, matching their
  MCP tools' input shapes.
• In src/openapi/spec.ts, registry.register the three schemas as components, then add
  registerPath entries for the GET, the POST (propose), and the POST :id/:decision (decide)
  routes, following the pattern already used for /v1/repos/{owner}/{repo}/agent/audit-feed.
• Schema is the contract — regenerate and commit. Run npm run ui:openapi after the edits and
  commit the regenerated apps/loopover-ui/public/openapi.json in this same PR. CI enforces this via
  npm run ui:openapi:check (part of npm run test:ci).

Deliverables

• Three new response schemas (plus request-body schemas for the POST verbs) added to
  src/openapi/schemas.ts.
• All three routes registered as OpenAPI paths in src/openapi/spec.ts.
• apps/loopover-ui/public/openapi.json regenerated via npm run ui:openapi and committed.
• npm run ui:openapi:check passes in CI.

All deliverables are required in this one PR — there is no follow-up issue.

Test Coverage Requirements

99%+ Codecov patch target (codecov/patch, unsharded via npm run test:coverage) on any new schema
helper code. Add a regression test asserting all three paths appear in buildOpenApiSpec()'s output
with response schemas whose keys match each route's MCP tool output shape.

Expected Outcome

The agent pending-actions approval-queue routes are documented in GET /openapi.json /
apps/loopover-ui/public/openapi.json, matching what their MCP tools already validate, and
consistent with their already-documented agent/audit-feed neighbor.

Links & Resources

• src/api/routes.ts: the three agent/pending-actions* routes above
• src/mcp/server.ts: listPendingActionsOutputSchema, proposeActionOutputSchema,
  decidePendingActionOutputSchema
• src/openapi/spec.ts: /v1/repos/{owner}/{repo}/agent/audit-feed registration (neighboring
  pattern to mirror)
• OpenAPI spec is missing GET /v1/repos/{owner}/{repo}/gate-config/effective (documented sibling: live-gate-thresholds) #6611 — the precedent issue for this exact class of gap

[linear-code]

JSO-6462