feat(ndo): DELETE endpoints for schemas and tenants (v0.22.0)

F5 fidelity gap: cisco.mso mso_schema/mso_tenant state=absent send
DELETE /mso/api/v1/schemas/{id} and DELETE /mso/api/v1/tenants/{id};
both were unrouted (405), blocking E2E baseline cleanup.

- DELETE schemas/{id}: removes detail + summary (seeded or extra) +
  policy-states; 404 on unknown id. No cascade into the APIC deploy
  mirror — real NDO orphans deployed objects on schema delete.
- DELETE tenants/{id} (+ bare /api/v1 alias, matching the GET pair):
  400 while any schema template tenantId references the tenant,
  200 once dereferenced, 404 on unknown id.
- tests/test_ndo_delete.py: 8 tests incl. no-cascade mirror check.

Full suite: 922 passed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017zdUTqU9fvCCvF3uVGZsu1

CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 (pre-1.0: minor bumps may include breaking changes to the sim's behavior).
 
+## [0.22.0] - 2026-07-08
+
+### Added
+- **NDO DELETE endpoints — schemas and tenants (F5)**:
+  `DELETE /mso/api/v1/schemas/{id}` removes a schema (detail, summary —
+  seeded or runtime-POSTed — and policy-states record; unknown id → 404)
+  and `DELETE /mso/api/v1/tenants/{id}` (+ bare `/api/v1/tenants/{id}`
+  alias, same dual-shape pair as GET /tenants) removes a tenant.
+  `cisco.mso.mso_schema` / `mso_tenant` with `state=absent` send exactly
+  these requests and previously got 405, blocking E2E baseline cleanup.
+  Real-NDO guard: a tenant still referenced by any schema template's
+  `tenantId` is refused with a 400 ("referenced by schema(s) …") until
+  the referencing schemas are deleted. Schema deletion deliberately does
+  NOT cascade into the APIC deploy mirror — real NDO does not undeploy on
+  schema delete, so already-deployed objects stay orphaned on the sites'
+  APICs unless the caller undeploys first (`POST /mso/api/v1/task` with
+  `undeploy`).
+
 ## [0.21.0] - 2026-07-07
 
 ### Added