fix(spec): METHOD_BINDING_MISMATCH never fires for validation-carrying handlers

[yeongseon]

Context

PR #366 (#362) added WarningCode.METHOD_BINDING_MISMATCH to flag an explicit @openapi(method=...) that the HTTP binding does not serve. However, the _binding_methods stamp that spec._collect_binding_mismatch_warnings() reads is only written at bridge.py:157, inside _reconcile_openapi_binding().

_reconcile_openapi_binding() is reached only for plain @openapi handlers (no endpoint/validation metadata) via the early-continue at bridge.py:558. Handlers that carry validation/endpoint metadata and an explicit @openapi(method=X) proceed into the metadata-merge path below, which never stamps _binding_methods. As a result, METHOD_BINDING_MISMATCH never surfaces for those handlers — the most common real-world case.

Surfaced by the Copilot review on PR #366 (comment on spec.py:856).

Acceptance Checklist

• Stamp _binding_methods on the merged entry in the metadata-carrying scan path when the entry's method came from an explicit @openapi(method=...).
• METHOD_BINDING_MISMATCH fires for a validation-carrying handler whose explicit method is absent from the binding's served verbs.
• No false positives for unspecified-method bindings or subset/inferred methods.
• Regression tests cover the validation-carrying positive and negative cases.
• make check-all passes with coverage >= 95%.

Out of scope

• The plain-@openapi mismatch path already covered by feat(spec): emit METHOD_BINDING_MISMATCH warning for explicit method vs binding #362 / PR fix(bridge): infer route+method for plain @openapi and flag binding mismatch #366.
• refactor(registry): function_id one-to-many re-scan resolution after explode #363 (one-to-many _function_id resolution), refactor(bridge): binding-first invariant resolution model for discovery #364 (binding-first invariant).

References

• PR fix(bridge): infer route+method for plain @openapi and flag binding mismatch #366 (introduces METHOD_BINDING_MISMATCH)
• Copilot review comment on src/azure_functions_openapi/spec.py:856
• bridge.py:157 (only stamp site), bridge.py:558 (plain-only call site)