feat: make Registry Stack authoritative for public identifiers

[jeremi]

Pull Request

Summary

Make registry-stack the release-scoped source of truth for identifiers published under
https://id.registrystack.org/.

• Generate one deterministic, active-only catalog with 37 entries: 26 Relay V2 problem types,
  4 JSON Schemas, 1 namespace, 2 vocabularies, and 4 vocabulary terms.
• Remove retired products and contracts from the publication inventory instead of preserving
  retirement records.
• Bind every entry to its owning source SHA-256 digest, every schema to its exact artifact digest,
  and every identifier to an explicit compatibility line.
• Validate identifier references across Git-tracked repository files. The lightweight closure
  check now runs on every PR, while source-owning changes still select the full export and
  reproducibility job.
• Reject stale reference exclusions that match no tracked file. Untracked local build and scratch
  files no longer affect catalog generation.
• Remove the retired Relay V1 namespace from Manifest's built-in vocabulary prefixes. This is a
  breaking pre-1.0 change; the changelog documents migration to absolute IRIs or an explicitly
  declared institution-owned vocabulary.
• Generate the Relay V2 problem inventory and audit-event schema from runtime-owned Rust
  definitions without changing runtime response behavior.
• Require release manifests from version 0.19.1 onward to bind the catalog path, digest, and
  active entry count. Historical manifests validate those bytes at their recorded source commit, so
  later catalog changes cannot invalidate earlier releases. The V1 Relay/Notary release inventory
  remains only for validating historical v0.10-v0.16 manifests; current v0.19+ releases use the
  Relay V2 inventory.
• Add focused CI routing, an explicit cross-repository Definition of Done, and public contract
  documentation for removal and adopter-owned vocabulary semantics.

Companion publisher PR: registrystack-id#1.
It currently pins the earlier reviewed PR head, 558c3423c4cd20b73556653f80feb6a4a65dcbcc; the current PR head is 9e36e67c63b95a1234853417ef234c14b394b1f6. Its catalog SHA-256 remains
545c3f9d9910d5190194f8027a7adaa75e7d6fc826515ee686de34b1c2f2a467. That publisher pin is
provisional and must be replaced with the exact resulting Registry Stack main commit after this
PR merges.

Checks

• products/identifiers/scripts/check.sh (12 generator and closure tests plus reproducibility)
• python3 .github/scripts/test_ci_changes.py (56 tests)
• python3 -m unittest release/scripts/test_registry_release.py (83 tests)
• python3 -m unittest release/scripts/test_registry_release_plans.py (20 tests)
• cargo fmt --check
• cargo test --locked -p registry-manifest-core -p registry-manifest-cli
• cargo test --locked -p registry-relay
• cargo test --locked -p registry-relay --all-features
• cargo run --locked --profile ci -p registry-manifest-cli -- validate-profiles products/manifest/profiles
• products/relay-v2/scripts/check-contracts.sh
• cargo test --locked -p registry-relay-v2 --all-features
• cargo clippy --locked -p registry-relay-v2 --all-targets --all-features -- -D warnings
• cd docs/site && npm run check
• cd docs/site && npm test (371 tests)
• actionlint
• git diff --check

All passed. The explicitly network-dependent SDMX schema test remains ignored by the existing test
suite. Vale reported zero errors and zero warnings, with one existing suggestion outside this
change.

Review notes

Security review found no changed runtime principal, authorization, disclosure, audit ordering,
source access, credential, signing, route, or error-redaction boundary. problem.rs emits the
same closed, value-free problem facts from one inventory macro.

The contracts page contains Tier-C trust-boundary wording. Maintainer source-pack sign-off against
the applicable Registry Stack security specifications is required before merge, specifically for
the claim that identifier resolution creates no runtime authentication, authorization, or
disclosure authority.

The catalog is a publication contract. Removing an entry makes the resolver return 404; a
removed URI must remain absent and must never be reused or repurposed.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b547df88b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".