fix(openapi): adopt legacy Microsoft integrations

[capeflow]

Outcome

Repairs scoped Microsoft integrations that were registered after the provider-service split but retained the retired microsoft runtime owner. It also keeps declared resource scopes intact when authorization-server metadata advertises only OIDC scopes, as Microsoft does for Graph.

Safety

• Preserves the integration slug, config, OAuth client, connection row, credential references, and source blobs.
• Copies spec and definitions serving state before changing ownership.
• Moves operation, tool, and definition ownership to OpenAPI.
• Fails closed on missing source blobs or conflicting operation rows.
• Is idempotent and leaves the default Microsoft monolith to the existing broad split migration.

Verification

• Microsoft ownership migration: 2 tests pass.
• Exact Cloudflare upgrade state: 5 tests pass.
• OAuth scope contract: 14 tests pass.
• Repository format and zero-warning lint pass.
• All 44 package typechecks pass.
• Full matrix: all affected suites pass. Three unrelated cloud org API-key revoke tests fail deterministically on unchanged origin/main because their test calls omit the now-required organization selector.