Green up

Tracking docs/openapi.json (so the app can serve the spec at runtime) makes docs/ exist on the published GitHub mirror, which defeated the skipif(not DOCS.is_dir()) guard in the docs publish/version tests: they then ran against a prose-less checkout and failed on CI. Key the skip off docs/*.md prose instead, matching the canonical published-checkout definition in scripts/check-gates-ran.sh.

Also: the OpenAPI generator emitted a trailing-slash path (/api/docs/), which a strict proxy like IIS treats as a redirecting resource a subpath-mounted client cannot follow; normalise trailing slashes in _norm_path and correct the committed spec. And allow docx (python-docx) as an undeclared import: it is used only by scripts/docs/generate_docx.py, a developer tool that never runs on a deployed site.

tests/test_docs_versions.py

@@ -23,9 +23,14 @@ import pytest
 REPO = Path(__file__).resolve().parents[1]
 DOCS = REPO / 'docs'
 
+# docs/openapi.json is tracked so the app can serve it at runtime, so docs/
+# exists even on the published mirror where the authored prose is not. Keying
+# the skip off the directory made this module run on the mirror against a
+# prose-less tree and fail. A published checkout is one with no docs/*.md prose,
+# matching the canonical definition in scripts/check-gates-ran.sh.
 pytestmark = pytest.mark.skipif(
-    not DOCS.is_dir(),
-    reason='no docs/ in this checkout - it is excluded from publication')
+    not any(DOCS.glob('*.md')),
+    reason='no docs/ prose in this checkout - it is excluded from publication')
 
 # The map is generated and the changelog records history; both are allowed to
 # carry literal versions. CONTRACT-STABILITY's table is a history of what each