coreapi: collect upstream API fixes into one checklist

The "fix this in the control-plane spec/surface" notes were scattered across code comments. Consolidate them into internal/coreapi/UPSTREAM.md as a running checklist, each entry naming the symptom, the upstream fix, and the workaround it lets us delete here:

1. nullable arrays as type-union shorthand → emit non-nullable arrays
2. operations declaring only 200 but returning 201/204 → declare real success codes
3. by-mirror lookup returns repoId while delete takes mirrorId → name the field mirrorId or add a delete-by-coords route

Point the normalize.go header and the repo_mirror.go remove comment at the file so they don't drift.