feat: deprecate legacy API actions

[bezbac]

No description provided.

[claude]

🟡 The V3_DEPENDENT_OPERATIONS set in scripts/openapi-deprecations.ts lists GET /api/public/scores/{scoreId}, but that path only has a DELETE method (legacy_scoreV1_delete) — no such GET exists. Because isV3DependentOperation() matches on the exact method+path string, this means the legacy score-delete endpoint never gets marked deprecated: true in openapi.yml, unlike its siblings (legacy_observationsV1_get/getMany, legacy_metricsV1_metrics). The set should use DELETE /api/public/scores/{scoreId} instead; several other entries (e.g. POST /api/public/traces, POST/PATCH /api/public/generations and /spans, POST /api/public/events, GET /api/public/metrics/daily, GET /api/public/scores) are similarly dead no-ops that should be cleaned up.

Extended reasoning...

scripts/openapi-deprecations.ts (lines 1-24) hardcodes a set of METHOD path strings that isV3DependentOperation() in scripts/patch-openapi.ts checks via exact string match against each operation in openapi.yml. When a match is found, the patch script sets deprecated: true and prepends [DEPRECATED] to the operation's summary.

One of the entries is "GET /api/public/scores/{scoreId}". Looking at openapi.yml, the path /api/public/scores/{scoreId} (around line 2439) has only a single method defined: delete, with operationId: legacy_scoreV1_delete and tags: [LegacyScoreV1]. There is no get method at that path at all — the set entry references an operation that doesn't exist.

Because isV3DependentOperation does an exact string match on ${method.toUpperCase()} ${path}, this dead GET entry never matches anything, and — critically — the real legacy delete operation at that same path is never checked, because DELETE /api/public/scores/{scoreId} isn't in the set at all. The result: this operation is the only Legacy*V1 endpoint that does NOT receive deprecated: true / the [DEPRECATED] summary prefix in the generated openapi.yml, while its direct siblings legacy_observationsV1_get, legacy_observationsV1_getMany, and legacy_metricsV1_metrics all do.

Step-by-step proof:

1. scripts/openapi-deprecations.ts line ~15: "GET /api/public/scores/{scoreId}", is added to V3_DEPENDENT_OPERATIONS.
2. scripts/patch-openapi.ts iterates every path/method pair in openapi.yml and calls isV3DependentOperation(path, method).
3. For path = "/api/public/scores/{scoreId}", method = "delete", the check computes "DELETE /api/public/scores/{scoreId}" and looks it up in the set — not found (the set has GET, not DELETE, for this path) — so no deprecation is applied.
4. There is no get method under /api/public/scores/{scoreId} in openapi.yml for the GET entry to ever match against, so that set entry is permanently a no-op.
5. Confirmed by grepping the generated openapi.yml: the delete operation at that path lacks deprecated: true and the [DEPRECATED] summary prefix, while GET /api/public/observations, GET /api/public/observations/{observationId}, and GET /api/public/metrics (the other Legacy*V1 siblings) all have both.

This doesn't break anything functionally — the delete endpoint still works exactly as before — but it defeats the stated purpose of this PR (deprecating legacy v3-dependent API actions) for one specific operation, and it will silently continue to look "supported" in CLI help / generated docs after the v4 migration when other legacy endpoints show .

Several other set entries are also dead no-ops matching no real operation in the current spec (POST /api/public/traces, POST /api/public/events, POST/PATCH /api/public/generations, POST/PATCH /api/public/spans, GET /api/public/scores, GET /api/public/metrics/daily), which corroborates that this list was curated against a stale/hypothetical set of paths rather than the actual spec, and should be cleaned up alongside the swap.

Fix: replace "GET /api/public/scores/{scoreId}" with "DELETE /api/public/scores/{scoreId}" in V3_DEPENDENT_OPERATIONS, and remove the other dead entries that match no operation in openapi.yml.