Validates OpenAPI shape, auth naming, paths, and public/protected clarity.
Built-in suites describe real checks, but no pass/fail result is claimed until a run persists evidence.