Bump Microsoft.OpenApi once a release carries microsoft/OpenAPI.NET#3108 #211

What

The generator carries its own components-key rule without a match timeout
(tools/OpenCode.Sdk.Tools/Generator/Ingestion/ComponentKeyRule.cs, installed by
tools/OpenCode.Sdk.Tools/Generator/Ingestion/SpecReader.cs:72). The library rule's regex checks a
100 ms wall-clock timeout on every match, so a thread paused by a garbage collection or the
scheduler fails a valid spec intermittently (microsoft/OpenAPI.NET#3101, reported from this
repository). When a Microsoft.OpenApi release carries the fix
(microsoft/OpenAPI.NET#3108), bump the package and delete the rule, after
confirming in the shipped assembly that the generated key regex no longer checks its timeout.

Why it waits for 1.1

It waits on an external release; the workaround is in place and correct.

Evidence

• Directory.Packages.props:36 (Microsoft.OpenApi 3.10.2).
• docs/ROADMAP.md:119-123.

Done when

• The bump lands with the rule deleted, generate --verify byte-identical, and the ROADMAP entry
  removed.