fix(openapi): hide antigravity/native-permission runtime hooks from the reference

The Claude, Codex, and Cursor elicitation/permission-request hooks are
internal harness callback webhooks and already carry
`include_in_schema=False`, but two newer siblings —
`antigravity-elicitation-request` and `native-permission-request` —
were added without the flag, so they leaked into the published OpenAPI
reference. Add `include_in_schema=False` to both, matching the existing
hidden hooks, and regenerate `openapi.json` (the only spec change is the
removal of those two paths). Drift test passes.

Co-authored-by: Isaac

omnigent/server/routes/sessions.py

@@ -15136,6 +15136,8 @@ def create_sessions_router(
 
     @router.post(
         "/sessions/{session_id}/hooks/antigravity-elicitation-request",
+        # Internal harness callback webhook — hidden from the public API reference.
+        include_in_schema=False,
         response_model=None,
         # CSRF hardening: body is parsed via request.json(); require a JSON
         # Content-Type so a cross-site text/plain request can't reach it.
@@ -15321,6 +15323,8 @@ def create_sessions_router(
 
     @router.post(
         "/sessions/{session_id}/hooks/native-permission-request",
+        # Internal harness callback webhook — hidden from the public API reference.
+        include_in_schema=False,
         response_model=None,
         dependencies=[Depends(require_json_content_type)],
     )

openapi.json

@@ -7615,90 +7615,6 @@
         ]
       }
     },
-    "/v1/sessions/{session_id}/hooks/antigravity-elicitation-request": {
-      "post": {
-        "description": "Antigravity (agy) elicitation request endpoint.\n\nReceives `{\"elicitation_id\": <str>, \"params\": <ElicitationRequestParams>}`\nfrom the interaction bridge (Task 8), which POSTs here when it\nsurfaces an agy WAITING interaction for the web UI. Parks the call\non the shared harness elicitation registry, emits the standard\n`response.elicitation_request` SSE event, waits for the session\n`approval` verdict, then returns the raw\n`~omnigent.server.schemas.ElicitationResult` so the bridge\ncan forward it to agy via `HandleCascadeUserInteraction`.\n\nThis is intentionally simpler than the Codex hook: the bridge\n(not the endpoint) builds the agy interaction payload via\n`to_interaction_payload`, so this endpoint only passes back\nthe verdict as-is.  The body shape is minimal and symmetric:\n`elicitation_id` from the bridge's deterministic id function\n(`agy_elicitation_id`), `params` as an\n`~omnigent.server.schemas.ElicitationRequestParams` dict.\n\n**Returns:** `ElicitationResult` JSON on user verdict; `200` with empty body on timeout/disconnect (bridge interprets as `None`).\n\n**Raises**\n\n- `OmnigentError` \u2014 404 if the session does not exist, 400 if the request body is malformed.",
-        "operationId": "antigravity_elicitation_request_hook_v1_sessions__session_id__hooks_antigravity_elicitation_request_post",
-        "parameters": [
-          {
-            "description": "Omnigent conversation id from the URL path.",
-            "in": "path",
-            "name": "session_id",
-            "required": true,
-            "schema": {
-              "title": "Session Id",
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            },
-            "description": "Successful Response"
-          },
-          "422": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            },
-            "description": "Validation Error"
-          }
-        },
-        "summary": "Antigravity Elicitation Request Hook",
-        "tags": [
-          "sessions"
-        ]
-      }
-    },
-    "/v1/sessions/{session_id}/hooks/native-permission-request": {
-      "post": {
-        "description": "Generic native-TUI tool-approval hook (TUI \u2192 web elicitation).\n\nThe vendor-agnostic counterpart of\n`cursor_permission_request_hook`, used by the hermes- and\ngoose-native approval mirrors. The runner-side mirror detects the\nvendor's in-terminal approval prompt, POSTs it here, and the server\npublishes `response.elicitation_request` and parks for the web verdict\n\u2014 the same registry/publish/cleanup path as the cursor/codex/claude\nhooks. An empty `200` (TUI answered, or timeout) leaves the vendor's\nnative prompt authoritative.\n\nUnlike the cursor hook, the card label / policy name come from the\npayload (`agent` / `policy_name`) so a Hermes or Goose approval is\nlabelled as such, not \"Cursor\".\n\n**Returns:** An `ElicitationResult` (`{\"action\": \u2026}`) on a web verdict, or `200` with empty body on TUI-resolution / timeout / disconnect.\n\n**Raises**\n\n- `OmnigentError` \u2014 404 if the session does not exist, 400 if the body is malformed.",
-        "operationId": "native_permission_request_hook_v1_sessions__session_id__hooks_native_permission_request_post",
-        "parameters": [
-          {
-            "description": "Omnigent conversation id from the URL path.",
-            "in": "path",
-            "name": "session_id",
-            "required": true,
-            "schema": {
-              "title": "Session Id",
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            },
-            "description": "Successful Response"
-          },
-          "422": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            },
-            "description": "Validation Error"
-          }
-        },
-        "summary": "Native Permission Request Hook",
-        "tags": [
-          "sessions"
-        ]
-      }
-    },
     "/v1/sessions/{session_id}/items": {
       "get": {
         "description": "List items in a session with cursor-based pagination.\n\nDelegates to the conversation items store \u2014 session_id is\nthe conversation_id. Same pagination contract as\n`GET /v1/conversations/{id}/items`.\n\n**Returns:** A `PaginatedList` of conversation items.\n\n**Raises**\n\n- `OmnigentError` \u2014 404 if no session exists.",