fix(codegen): emit single-value Literals for discriminator fields

Pydantic 2.12+ requires a discriminated-union member's discriminator field
to be typed as `Literal[...]`. datamodel-codegen was emitting it as a
single-value `StrEnum` (e.g. `kind: Kind` where `Kind(StrEnum)` had one
entry), which causes Pydantic to refuse to build the union with:

    PydanticUserError: Model 'X' needs field 'kind' to be of type `Literal`

This affects any sealed hierarchy on the API side that currently has only
one variant (and trips immediately when an oneOf is exposed before the
second variant lands, e.g. `AuditMetadata` introduced in mono PR #283).

Fix:
  - scripts/typegen.sh: pass `--enum-field-as-literal one` and
    `--use-one-literal-as-default` to datamodel-codegen.
  - Single-value enums now render as `kind: Literal["..."] = "..."`,
    which both satisfies the discriminator requirement and lets callers
    omit the obvious value.
  - Regenerate src/devhelm/_generated.py (net -310/+78 lines: most of
    the noisy single-value StrEnum classes collapse into inline Literals).
  - Update one negative test (`TestConfirmationPolicyNegative.test_missing_type`)
    to reflect the new defaulting behaviour and document the rollback
    when a second variant is added.

No public-API changes for callers that already passed the discriminator
explicitly. Branch name matches the mono PR so the spec-evolution harness
on devhelmhq/mono#283 picks it up automatically.

Made-with: Cursor

Author: caballeto

scripts/typegen.sh

@@ -52,9 +52,22 @@ uv run datamodel-codegen \
   --use-annotated \
   --field-constraints \
   --snake-case-field \
+  --enum-field-as-literal one \
+  --use-one-literal-as-default \
   --input-file-type openapi \
   --formatters ruff-format
 
+# Why --enum-field-as-literal=one + --use-one-literal-as-default?
+#
+# Without these, single-value enums (used as discriminators on sealed unions
+# like AuditMetadata.kind) generate as `kind: Kind` where `Kind(StrEnum)` has
+# one entry. Pydantic 2.12+ rejects this when the parent is a discriminated
+# union: "Model 'X' needs field 'kind' to be of type `Literal`".
+#
+# These flags make the codegen emit `kind: Literal["..."] = "..."` instead,
+# satisfying the discriminator requirement and making the field optional at
+# construction (callers don't need to repeat the discriminator value).
+
 # Post-process: inject `model_config = ConfigDict(extra='forbid')` into every
 # generated class so that requests with unknown fields and responses with
 # unknown fields BOTH fail loudly. Implements P1 + P2 from