fix: pin oapi-codegen version via go.mod tool directive (#210)

## Summary

- Adds `tool github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen`
directive to `server/go.mod`, pinning oapi-codegen at v2.6.0 via go.sum
- Switches `server/Makefile` from `go install ...@latest` to `go tool
oapi-codegen` so the pinned version is always used
- Removes the `OAPI_CODEGEN` binary variable and install target from the
Makefile (no longer needed)

This is the root cause fix for the version regression in #201 (where
`@latest` resolved to v2.5.1 instead of v2.6.0). PR #209 already
restored the generated code; this PR prevents it from happening again by
adopting the same `go.mod` tool directive pattern used in
`kernel/kernel`.

## Test plan

- [x] `go vet ./...` passes
- [x] Unit tests pass (`go test -race` on all non-e2e packages)
- [x] `go tool oapi-codegen -config ./oapi-codegen.yaml
./openapi-3.0.yaml` uses pinned v2.6.0
- [ ] CI server-test workflow passes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk build tooling change: it only affects OpenAPI code generation
and Go module dependency resolution, not runtime behavior. Main risk is
unexpected dependency/tooling differences if the pinned tool or updated
transitive deps behave differently across environments.
> 
> **Overview**
> **Pins `oapi-codegen` for reproducible OpenAPI generation.**
`server/go.mod` now declares `oapi-codegen` as a Go `tool` dependency
(and updates module sums), and `server/Makefile` switches
`oapi-generate` from installing `@latest` into `bin/` to invoking `go
tool oapi-codegen`.
> 
> This removes the Makefile’s local `oapi-codegen` install
target/variable and updates Go module dependencies (including bumping
`github.com/getkin/kin-openapi` to `v0.133.0`) to reflect the pinned
toolchain.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
d7632bf. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: rgarcia

server/Makefile

@@ -2,7 +2,6 @@ SHELL := /bin/bash
 .PHONY: oapi-generate build dev test clean
 
 BIN_DIR ?= $(CURDIR)/bin
-OAPI_CODEGEN ?= $(BIN_DIR)/oapi-codegen
 RECORDING_DIR ?= $(CURDIR)/recordings
 
 $(BIN_DIR):
@@ -11,17 +10,14 @@ $(BIN_DIR):
 $(RECORDING_DIR):
 	mkdir -p $(RECORDING_DIR)
 
-$(OAPI_CODEGEN): | $(BIN_DIR)
-	GOBIN=$(BIN_DIR) go install github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen@latest
-
 # Generate Go code from the OpenAPI spec
 # 1. Convert 3.1 → 3.0 since oapi-codegen doesn't support 3.1 yet (https://github.com/oapi-codegen/oapi-codegen/issues/373)
-# 2. Run oapi-codegen with our config
+# 2. Run oapi-codegen with our config (version pinned via go.mod tool directive)
 # 3. go mod tidy to pull deps
-oapi-generate: $(OAPI_CODEGEN)
+oapi-generate:
 	pnpm i -g @apiture/openapi-down-convert
 	openapi-down-convert --input openapi.yaml --output openapi-3.0.yaml
-	$(OAPI_CODEGEN) -config ./oapi-codegen.yaml ./openapi-3.0.yaml
+	go tool oapi-codegen -config ./oapi-codegen.yaml ./openapi-3.0.yaml
 	@echo "Fixing oapi-codegen issue https://github.com/oapi-codegen/oapi-codegen/issues/1764..."
 	go run ./scripts/oapi/patch_sse_methods -file ./lib/oapi/oapi.go -expected-replacements 3
 	go fmt ./lib/oapi/oapi.go

server/go.mod

@@ -2,14 +2,16 @@ module github.com/kernel/kernel-images/server
 
 go 1.25.0
 
+tool github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen
+
 require (
 	github.com/avast/retry-go/v5 v5.0.0
 	github.com/coder/websocket v1.8.14
 	github.com/creack/pty v1.1.24
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getkin/kin-openapi v0.132.0
+	github.com/getkin/kin-openapi v0.133.0
 	github.com/ghodss/yaml v1.0.0
 	github.com/glebarez/sqlite v1.11.0
 	github.com/go-chi/chi/v5 v5.2.1
@@ -42,6 +44,7 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/ebitengine/purego v0.8.4 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -67,6 +70,7 @@ require (
 	github.com/moby/term v0.5.0 // indirect
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/oapi-codegen/oapi-codegen/v2 v2.6.0 // indirect
 	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
 	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
@@ -78,8 +82,12 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/shirou/gopsutil/v4 v4.25.6 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/speakeasy-api/jsonpath v0.6.0 // indirect
+	github.com/speakeasy-api/openapi-overlay v0.10.2 // indirect
 	github.com/tklauser/go-sysconf v0.3.12 // indirect
 	github.com/tklauser/numcpus v0.6.1 // indirect
+	github.com/vmware-labs/yaml-jsonpath v0.3.2 // indirect
+	github.com/woodsbury/decimal128 v1.3.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
@@ -90,7 +98,9 @@ require (
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/mod v0.28.0 // indirect
 	golang.org/x/text v0.30.0 // indirect
+	golang.org/x/tools v0.37.0 // indirect
 	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect