The OpenAPI description names every refusal of POST …/builds and the fields of a build pin, so an agent reads them before it is refused #9094

Intent: an agent can learn from the OpenAPI document how pinning a build is refused and what a pin holds, the way the PATCH and DELETE build routes already say it.

Today src/contract/openapi/routes/postApiV1ReposOwnerNameBuilds.ts lists one refusal, exists. pinBuild (src/actions/builds.ts, src/git/builds.ts PinBuildError) also answers invalid_label, invalid_parent and not_a_commit as 422 and git_failed as 422 (through STATUS in src/http/api/builds.ts), plus forbidden (403, an agent or a reader), not_found (404) and mirrored (409). getApiV1ReposOwnerNameBuilds.ts and the POST give no reply, so the fields of BuildPin (label, oid, note, parent, source, pinnedBy, pinnedAt, notes) are not described anywhere an agent reads.

Done looks like:

• [x] The POST route's refusals name each code above with its status and one plain line, worded as the PATCH and DELETE build routes word theirs.
• [x] The GET and POST routes carry a reply naming the pin's fields: items and next_cursor for the GET, the pin itself for the POST.
• [x] A test derives the expected codes from the handler, not from a copied list. For example, it drives the POST with a bad label, a bad parent, a missing commit, a taken label, an agent and a mirrored repository, and expects each error it gets back to be among the refusals the served OpenAPI JSON lists for post /api/v1/repos/{owner}/{name}/builds. It fails on main.
• [x] bun test passes.

Files expected: src/contract/openapi/routes/postApiV1ReposOwnerNameBuilds.ts, src/contract/openapi/routes/getApiV1ReposOwnerNameBuilds.ts, one test (or a case in test/build-pins.test.ts).

Risks: #9087 (OpenAPI limit bounds) is in flight on the same document. Touch only these two route files and the test so the two merge cleanly. Do not change what the routes answer: if the test finds a code the handler answers that the document cannot honestly name, say so in the pull rather than reshaping the handler.

Fits: scout or torque.

Reviewed pull #9102 at its head: ticked The POST route's refusals name each code above with its status and one plain line, worded as the PATCH and DELETE build routes word theirs.; The GET and POST routes carry a reply naming the pin's fields: items and next_cursor for the GET, the pin itself for the POST.; A test derives the expected codes from the handler, not from a copied list. For example, it drives the POST with a bad label, a bad parent, a missing commit, a taken label, an agent and a mirrored repository, and expects each error it gets back to be among the refusals the served OpenAPI JSON lists for post /api/v1/repos/{owner}/{name}/builds. It fails on main.; bun test passes..