fix(compilers/openapi): read $id past an empty pointer segment

[OmarAlJarrah]

Summary

declaresResourceIDAbove (compilers/openapi/internal/schema/schema.go) walks a JSON Pointer down
from the document root looking for the $id that starts a schema resource of its own, and skipped
every empty segment on the way. Only the leading empty segment is an artifact of splitting a
pointer on /; every later one is a real RFC 6901 reference token naming the key "", which is
exactly how a component schema named "" is addressed — /components/schemas/.

So a pointer ending in an empty token stopped the walk at the components/schemas map and never
read the position's own $id. dynamicChainVerdict then found no boundary and let a $dynamicRef
expansion cross into a schema resource it should have degraded at. That is the worse of the two
directions to err in, as the function's own comment records: a false boundary only costs an
expansion that would have been safe, while a missed one mints a reference the IR cannot express.

The walk now takes its path from nodeview, which already reads a pointer this way — #304 fixed the
same empty-token bug class there, one layer down — rather than tokenizing the pointer itself.

The lone slash is the same loss at the one spelling that survived.nodeview.PointerPath lands
/ on the document root, a deliberate departure from RFC 6901 that models where a reference
spelled that way resolves. Every pointer reaching this walk is a position the compiler built with
ids.Ptr, and ids.Ptr("") spells the root member keyed "" exactly / — so an $id written on
that member was walked past, and a $dynamicRef whose chain hops through it expanded across the
boundary. DocumentPath now carries the position reading beside PointerPath's reference reading,
sharing one walk body so the two cannot drift.

The view is built per walk, and that is load-bearing.nodeview memoizes a mapping's merge
expansion, so a node first expanded shallowly is served from that memo to a later walk reaching it
deeper than MergeDepthLimit allows. A view that outlives one walk therefore makes the verdict
depend on which schema lowered first — one document here keeps a reference verbatim declared
P-then-Q and expands it declared Q-then-P, which invariant #7 forbids.

A second site of the same empty-name mechanism.ids.ComponentEntry also treats an empty name as
no name. There it is deliberate and recorded — an entry keyed "" earns no named TypeID and hoists
anonymously, per testdata/conformance/openapi/empty-names.yaml — so the behaviour is unchanged.
What was wrong is what the $dynamicAnchor path said about it: declared at "/components/schemas/" rather than on a component schema, which the document contradicts, since that pointer addresses a
component schema. The refusal stands; the reason now says an empty name earns no named type to
expand to.

Test plan

gofmt, go vet, golangci-lint run (0 issues), go build ./... and ./scripts/check-coverage.sh
(5961/5961 statements) all pass, as does go run ./cmd/morphic-harness testdata/conformance/.

Probed end to end, not read. Three specs compiled before and after, with the full diagnostic list
read each time: a schema named "" carrying $id and $dynamicRef (now degrades at the boundary
instead of expanding); an anchor on a schema keyed "" (now says why rather than denying the schema
exists, while an anchor deeper in the document keeps the original wording); and a chain hopping
through the root member keyed "" (now degrades — this is the lone-slash case).

The corpus now reaches the fix. No committed spec combined an empty component name with $id and
$dynamicRef: empty-names.yaml has neither keyword, dynamic-ref.yaml had no empty key. So no
oracle drove the fixed path. dynamic-ref.yaml now writes that combination, and reverting the fix
reddens the conformance case.

Order-invariance is asserted directly, because the sweep cannot ask. The construct needs YAML
anchors, and internal/harness's reverseMappings declines to permute a document whose aliases the
reversal would lift above their anchors — so orderInvariant returns ok without comparing
anything. A spec whose verdict provably flips with declaration order sweeps clean. The two-order diff
is therefore written out by hand, and restoring a view that survives one walk reddens it.

The tests were watched failing. Reintroducing the empty-segment skip reddens the trailing- and
interior-token cases and the conformance case; reading / as the root reddens the lone-slash case;
a surviving view reddens the two-order test; making the component-schema predicate answer false
reddens the reworded-diagnostic case. Each was planted and observed, with the source restored after.

The rootward cases needed the fixture changed to say anything. With no $id at or under the root,
"the walk stopped at the root" and "the walk descended and fell off the tree" both produce false,
so the case could not tell them apart. The fixture now parks an $id on a root member keyed "",
which the empty pointer must not reach and / must.

Scope

Everything found while probing this change that is not fixed here is filed, so nothing rests on a
commit message or a review thread:

• openapi: nodeview's expansion memo makes an answer depend on the depth a node was first expanded at #404 — the root cause behind the reverted view sharing. View.expand serves a cached
  expansion as complete regardless of the depth the caller reached the node at, so a node memoized
  shallowly answers a later walk that should have truncated. That is why no nodeview.View can be
  shared across independent walks today.
• openapi: a merge chain past MergeDepthLimit hides an $id, expanding a $dynamicRef across a resource boundary #401 — a path node whose own merge chain exceeds MergeDepthLimit expands to nothing, so an
  $id written there is invisible and this same walk reports no boundary. Noted in the code comment
  on declaresResourceIDAbove, since it is a live gap in the function this PR touches.
• openapi: the cycle pre-scan's merge-bound warning depends on declaration order #402 — the cycle pre-scan shares one view across its whole walk, so whether it reports hitting
  the merge bound depends on declaration order. The same mechanism as openapi: nodeview's expansion memo makes an answer depend on the depth a node was first expanded at #404, in a different walk.
• harness: the order-invariance oracle silently declines on any document using YAML anchors #403 — the order-invariance oracle's four silent-decline paths are indistinguishable from a
  pass, which is why openapi: the cycle pre-scan's merge-bound warning depends on declaration order #402 and the reverted view sharing both swept clean.
• openapi: the component classifier collapses "no such entry" with "an entry keyed \"\"", so callers can restate a falsehood #405 — ComponentSchemaName still collapses "no such entry" with "an entry keyed """ for
  every caller that does not know to ask ComponentSchemaNamedEmpty, so the falsehood this PR fixed
  can recur at the next site that reports the same refusal.

Closes#302