feat(ir)!: add Deprecation.RemovalDate; promote x-extensible-enum - #439

ir.Enum has carried a Closed bool since the IR was written, and the OpenAPI
compiler set it true at both construction sites unconditionally. So the one
key the format has for saying an enum is open, x-extensible-enum, survived
only as a generic vendor_extension entry, and every consumer reading typed
fields saw a closed enum whatever the document said. Open versus closed
decides whether a generator emits a fallback member and whether a differ
calls an added value breaking, so this was a wiring gap, not a modelling one.

Add TargetEnumOpen to the promotion vocabulary, map x-extensible-enum onto it
by default, and apply it in attachDeclaredAnnotations beside the deprecation
promotion — the point at which a declaration's extensions have reached the
node's map, which is what makes "the extension survives its own promotion"
structural here as it is there. Every promotion property holds unchanged: the
entry stays put with its vendor_extension reason, the node records
extension-promotion in Provenance.Inferred, and a disabled policy writes
nothing.

The target names the fact rather than the field, which the rest of the
vocabulary does not. Openness is the only half of that bool a document ever
declares — a schema's `enum` is closed by definition — so a target named for
Closed could only ever be written false and would read as its own opposite at
every mapping naming it. For the same reason the key's presence is the
statement rather than its value: the established spelling writes the member
list as the value, and a list of members says nothing about openness the key
naming it has not already said. A boolean is the one shape that does state it
alone, so an explicit `false` is read as written rather than inverted.

Deliberately out of scope, and stated in ir-design.md and at the reading site:
a document writing x-extensible-enum *instead* of `enum`, with the members in
the extension, lowers to no ir.Enum at all and there is no node to open.
Minting one would be reading a member list out of a vendor key rather than
promoting a field; the entry survives verbatim for a consumer that wants to.

The corpus can now witness the matrix's open-enums row, so its
matrixRowsUncovered reason is deleted rather than left to go stale, and
extension-promotion.yaml gains the three enums that pin the three answers the
reading has: the convention opens one, an explicit false declines to, and an
enum naming no such key is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SYeBgDsskwnyitLgPGCPn1

JSON null decodes into a bool without error and leaves it false, so a bare
`x-extensible-enum:` — the presence-only spelling the reading exists for —
read as the explicit false that is the one way a document declines, with no
diagnostic. Decode into *bool so absence of a value is told apart from false,
and pin the null shape beside the list, the true and the prose the test
already covers.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011T5no6iADeMGgYjsYcV5in