v0.7.0 — expose remaining RunSpec knobs on /openai/v1/chat/completions

Additive. /openai/v1/chat/completions now accepts six more headers that
map one-to-one onto /run body fields, so OAI clients no longer have to
drop down to /run for schema validation, session resumes, or
tool-allowlist control:

  x-aicodebox-json-schema        JSON object — schema-validates the
                                 final assistant turn; flips the run to
                                 output_format=json-verbose so the
                                 adapter event stream is available
                                 end-to-end.
  x-aicodebox-resume             string — adapter session id to resume.
  x-aicodebox-extra-args         JSON array OR comma-separated string.
  x-aicodebox-timeout-seconds    int — per-run timeout.
  x-aicodebox-tools-allowlist    JSON array OR comma-separated string.
  x-aicodebox-no-tools           1/true/yes — disables tool surface.

Malformed header values surface as 400 with the offending header name
in the detail. Body-level tools / tool_choice / response_format=
json_object remain 400 — those are distinct OAI-protocol concerns from
the new tools_allowlist / no_tools / json_schema RunSpec knobs.

The streaming path is wired identically — same six knobs flow into the
streamed RunSpec.

No breaking changes. Existing OAI requests behave the same. Also ships
the FUNDING.yml that was committed but untagged on top of v0.6.0, and a
backfilled CHANGELOG.md covering every release from v0.1.0.