Conceptually, we want:

1. An OpenAPI spec that represents the full shape of the "registry API", including optional features like vendor-specific extensions.
2. An OpenAPI spec that represents the official registry API, which should be a minimal subset of (1)
3. Automated validation that (1) and (2) are in sync and correspond to what is running live in production for the official registry API

We currently have (2) defined here.

(1) is not defined anywhere, but we can probably take (2) and build off it; just need to create a copy and work off that.

We'll want to tie (2) to be directly tied to the actual Go implementation in some way (whether by test suite or some more direct generation).

We'll probably want some test suite bridging (1) and (2).

Open to other suggestions for how to codify this, if folks think OpenAPI schemas are not the best way to do this.