chore: bump Speakeasy CLI to 1.787.0 and regenerate SDK

[christineschen]

TL;DR

Bumps the pinned Speakeasy CLI 1.763.2 → 1.787.0 (latest) and regenerates the SDK. Part of SUP-42. Draft pending review of one type-surface change (below).

Why this repo matters

This repo's .speakeasy/workflow.yaml pin is the source of truth for openrouter-web's CI: openapi-pr-comment.yaml and sdk-auto-regenerate-on-merge.yaml curl this file to decide which Speakeasy CLI to install for speakeasy lint / SDK checks. Merging this makes monorepo lint run under 1.787.0.

What changed

• .speakeasy/workflow.yaml + lockfiles: speakeasyVersion 1.763.2 → 1.787.0
• Regenerated SDK (152 files, mostly docs regeneration). Notable generated-code changes:
  • ⚠️ Streaming overload return types widened: per-overload narrowed returns (e.g. chatSend with stream: false returning models.ChatResult, stream: true returning EventStream<models.ChatStreamChunk>) now all return the operation response union (e.g. operations.SendChatCompletionRequestResponse = ChatResult | EventStream<ChatStreamChunk>). Same runtime behavior, but consumers who relied on overload narrowing must now narrow the union themselves. This affects chatSend, betaResponsesSend, and imagesGenerate. This is the newer generator's intended output — flagging for a decision on whether to ship as-is (likely a minor/major version bump) or investigate a gen.yaml option to restore narrowing.
  • SSE data field schemas: z.string().transform(...) → z.unknown() with a string guard (more lenient parse, non-breaking)
  • dlv / is-plain-object lib helpers removed in favor of inline code
  • Pagination uses direct property access instead of dlv
  • package.json gains generator-emitted security-floor overrides for transitive deps
• Prompt/lint surface: the newer CLI reports the known 22 generator-suggest-discriminator + 1 generator-duplicate-component-schemas hints (hints only — generation succeeds; deferred per SUP-42)

Verification

• npm run typecheck ✅ npm run lint ✅ (0 warnings) npm run build ✅
• npm run test ✅ 186/186 unit tests pass

Reviewer decision needed

1. Accept the widened streaming return types (breaking for type-level consumers → version-bump implications), or hold for a generator config that restores overload narrowing?
2. After merge, openrouter-web CI lint gets stricter — #26470 (already green under new lint) should land first.