build: consume any-sdk v0.5.4-alpha01 - OCI signing, server variable env resolution, pushdown $select superset, XML pagination token passthrough - #707

Consumes any-sdk v0.5.4-alpha01 (tag verified against the squash-merge commit 83c0a2e on any-sdk origin/main):

• [FEATURE] Add OCI request signing auth type (oci_signing_v1) any-sdk#118 - OCI request signing (oci_signing_v1)
• [FEATURE] Defensive: OData push-down $select should always be a superset of $filter/$orderby columns any-sdk#116 - OData push-down $select superset guard
• [FEATURE] schema_driven_xml: pass scalar payload siblings through the output envelope (pagination response tokens are dropped) any-sdk#117 - schema-driven XML scalar sibling (pagination token) passthrough
• x-stackQL-envVar env var resolution for OpenAPI server variables

Closes #706.

Changes

• go.mod/go.sum: any-sdk v0.5.3-alpha11 -> v0.5.4-alpha01; pulls in oracle/oci-go-sdk/v65 v65.120.0 and raises golang.org/x/*. No Go source changes - all four features flow through existing seams.
• docs/auth.md: oci_signing_v1 usage - raw (twelve-factor) and config-file variants, per-field env var indirection (examples use the OCI CLI names), precedence and fail-fast semantics.
• New mocked provider stackql_oci_testing (checked-in throwaway RSA key fixture, generated for this suite - not a real credential) with native_test mock routes that crack the draft-cavage Authorization header into columns (GET) and enforce the six-header body-verb contract including the x-content-sha256 digest (POST). Same mock-asserted authn pattern as the aws SigV4 suites, so a real OCI provider doc can drop straight in.
• New srvvar service on stackql_native_test with {deployment} as a path segment server variable carrying x-stackQL-envVar.
• odata service gains people_restricted with per-capability supportedColumns allowlists (existing people resource untouched).
• xml_ec2 service gains volumes_paged (two-page nextToken traversal).

Robot coverage (all new cases + full touched suites green)

• stackql_oci_auth.robot (new, 6 cases): GET keyId/rsa-sha256/exact date (request-target) host header list from env credentials; POST despatch proves the six-header set + digest (mock 400s otherwise); config-file variant with distinct identifiers proves the file is read; partial raw credentials fail fast with cannot compose OCI signing credentials before any request.
• stackql_server_variables.robot (new, 6 cases): env-resolved segment hit; WHERE beats env; unset env + WHERE supplied works; unset env fails; SHOW METHODS RequiredParams includes deployment only when the env var is unset.
• stackql_odata_pushdown.robot (+4): pushed filter / order-by columns join $select under an allowlist; filter on a column outside the select allowlist never reaches $select; SELECT * emits no $select.
• stackql_xml_walker.robot (+3): row count spans both pages, a page-two-only row materialises, and the token is not a result column.

Observed behaviours worth noting (pinned by the tests)

• Unset server variable with no WHERE value surfaces as cannot find any viable servers - any-sdk swallows the per-variable error inside server selection. The variable is named in SHOW METHODS RequiredParams. A friendlier "missing required parameter: deployment" message would need a core change; candidate follow-up issue.
• For a WHERE column outside the select allowlist, stackql unions the WHERE column into the pushdown projection, so any-sdk's all-or-nothing allowlist gate suppresses $select entirely (filter still pushes; client-side WHERE remains authoritative). Coherent wire shape, just stricter than the per-column skip the any-sdk unit tests exercise in isolation.
• OCI credentials travel only via the runtime --auth context; the provider-doc auth block carries the type. Relevant to the future OCI provider: docs declare type: oci_signing_v1 and users supply credentials exactly as the aws pattern does.

Housekeeping (rider)

• Removes the stale root server.json (the hand-published v0.10.500 registry artifact from Feature/mcp registry submissions #673) and its dead paths-ignore entries - the publish flow renders packaging/mcpb/registry/server.json from the template at release time and nothing reads the root copy.

Test plan

• go build ./..., unit tests, golangci-lint run (0 issues) - clean on the bumped dependency.
• Four touched robot suites: 42/42 pass locally (native/sqlite).
• Full functional sweep run locally (546 tests): 477 passed; every failure classified as local-environmental - 44 were a missing locally-built stackql_mcp_client (Mcp suite re-run after building it: 50/54), 21 mTLS key-permission failures inherent to /mnt/c, 4 version asserts on an unstamped local binary. Zero failures touch changed code.
• test/registry-mocked is generated (gitignored); CI regenerates via registry_rewrite.py, which copies the key fixture and maps the new provider to the default mock port.