Add TinyPen sender workflow for shared OpenAPI artifact sync

[Copilot]

TinyPen now owns the canonical shared OpenAPI artifact in a standard openapi/components/ location and can automatically propagate updates to cubap/rerum_openapi via PR. This enables downstream consumers to continue validating against the receiver repo without per-feature contract workflows.

• Canonical artifact in TinyPen

  • Added openapi/components/tinypen-shared-components.openapi.yaml as the source-of-truth shared contract artifact.
  • Structured as a valid minimal OpenAPI document so it is parseable by standard tooling.

• Sender-side sync workflow

  • Added .github/workflows/sync_tinypen_shared_openapi.yaml.
  • Triggers on main changes to the canonical artifact (and supports manual dispatch).
  • Checks out cubap/rerum_openapi, copies the source artifact to:
    • schemas/openapi/tinypen-shared-components.openapi.yaml
  • Opens or updates a sync PR in the receiver repo using a stable sync branch.

• Receiver stub enforcement + workflow hardening

  • Workflow explicitly fails if the receiver target file does not already exist, ensuring updates apply to a pre-seeded stub rather than creating first-run artifacts.
  • Added least-privilege workflow permissions and pinned third-party actions to commit SHAs.

on:
  push:
    branches: [main]
    paths:
      - openapi/components/tinypen-shared-components.openapi.yaml
  workflow_dispatch: