Add PATCH support for google-calendar events

[michielbdejong]

Summary

Part of the write-back gap closed by localthought/atomic-plugins#5 (Phase 1). The google-calendar composed OpenAPI document only ever declared GET operations — the base document (vendored in openapi-directory) is explicitly a "read-only subset" — so integration-proxy's Catalog::allows() rejected every write even though the OAuth scope had already been widened to calendar.events. Devonian's google-calendar lens (planCalendarEdit/applyCalendarEdit in localthought/devonian) has sent PATCH .../events/{id} with an If-Match header and a partial JSON body (summary/description/location/start/end) since it was written, but nothing in the catalog ever allowed that request through.

• auth-overlay.yaml: adds the patch operation on /calendars/{calendarId}/events/{eventId} (parameters, requestBody, If-Match header, 412 response) and its security requirement. Reuses the calendar.events scope already requested for the events GET operations, so no new user consent/reconnect is needed. This overlay runs first in catalog.json's list so crud-causality-overlay.yaml can layer x-crud on top of it afterwards.
• crud-causality-overlay.yaml: tags the new operation x-crud: {action: update, resource: event}.
• schema-overlay.yaml: documents the event.etag field devonian reads off GET responses to populate If-Match.
• catalog.json: pins the three changed overlay URLs to this branch's commit; pagination-overlay.yaml and identity-overlay.yaml are untouched and stay on their existing pins.
• tests/test_identity_overlays.py: new regression test asserting the composed events-patch operation's operationId, x-crud, security, request content type, and the etag schema field.

Replaces #165, which was based on main's tip — main has since gained an unrelated clockify catalog entry that fails Catalog::oauth_provider validation, so this branch is based on the currently-deployed pin (8f29d997) instead, to keep the production pin bump minimal. Same overlay content, different (clean) base.

A companion integration-proxy PR bumps DEFAULT_CATALOG_PATH to this branch's tip: localthought/integration-proxy#75

Test plan

• python3 -c "import yaml; ..." — all three edited overlay YAML files parse.
• python3 -c "import json; ..." — catalog.json parses.
• python tests/test_identity_overlays.py — all 3 tests pass, including the new one, against the composition fetched live from this branch's pushed commit (exercises openapi_spec_validator.validate() on the merged document via generate_identity_catalog_fixtures.compose()).
• integration-proxy's pinned-fixture tests pass against this branch's tip (see linked PR).
• Live write against a real Google account — not done here; needs a deployed integration-proxy and a real connected account.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YZYTjDU1jrJXXfQB1YPYLA

---

Generated by Claude Code

[michielbdejong]

Superseded by #167: ontola/openapi-directory removed the google-calendar/v3 subset document this PR was built against (see that PR's description for details) in favor of a regenerated, full calendar/v3 document. #167 replaces this PR's hand-written patch operation with a one-line security override on the operation the new base document already provides natively, and keeps the same x-crud/scope shape this PR established.

Closing this one in favor of #167.