feat: publish the Registry Stack identifier catalog

[jeremi]

Summary

Turn registrystack-id into the exact, active-only publisher for the authoritative Registry Stack
identifier catalog introduced by
registry-stack#710.

• Pin the exact merged Registry Stack main commit
  f688b4f2580e1feea409cd561647d9ad42770d6b and catalog SHA-256
  545c3f9d9910d5190194f8027a7adaa75e7d6fc826515ee686de34b1c2f2a467.
• Publish exactly 37 active identifiers. Relative to main, add 27 current identifiers, update 10
  retained identifiers, and remove 177 identifiers that are no longer current.
• Delete retired source records, generated pages, redirects, and unreferenced immutable artifacts.
  Removed paths return 404.
• Import only current Registry Stack fields. Historical publisher-only metadata can no longer
  survive a re-import, and checks reject extra source-catalog fields.
• Keep four imported schema artifacts under immutable SHA-256 paths while serving their canonical
  identifier paths.
• Publish compatibility-line metadata and state that dynamic vocab/core/* child terms are
  adopter-owned. Resolution does not register or review those terms.
• Reject catalog extras, non-active entries, source or artifact digest drift, kind changes, and
  unreferenced immutable artifacts.
• Require a deployment pin to be an ancestor of Registry Stack main. A PR-branch SHA can pass
  publisher CI for review but cannot deploy.
• Protect the daily automation branch against silently overwriting human or unexpected commits.
  Human changes belong in Registry Stack source or a separate publisher PR.
• Pass GitHub context into shell steps through environment variables.
• Pin the deployment workflow's upstream checkout, GitHub Actions, Node version, and Wrangler
  version; require only the existing Worker and route deployment scope.

Merged dependency provenance

registry-stack#710 merged as
f688b4f2580e1feea409cd561647d9ad42770d6b. This PR was re-imported from that exact Registry Stack
main commit, rebuilt, and revalidated. The deployment ancestry guard now accepts the pin.

Configure REGISTRYSTACK_ID_SYNC_TOKEN before the scheduled sync is enabled. It must be a
fine-grained token scoped only to this repository with Contents and Pull requests read/write
permissions. It is separate from Cloudflare deployment credentials and grants no deployment or DNS
authority.

Checks

• npm run build
• npm test (7 importer and change-report tests plus exact-field and deterministic-output checks)
• npm run check:upstream -- <registry-stack-worktree> (37 active records and all digests in sync)
• Local HTTP smoke: representative problem, schema, and namespace records return 200; the
  removed Relay V1 namespace returns 404
• npm run report:catalog -- origin/main
• actionlint
• git diff --check

All passed. The dynamic /vocab/core/* Cloudflare rewrite remains covered by the scheduled
canonical-host smoke because a local static server does not implement _redirects.

Security and operations

Identifier pages describe existing public contracts. They create no principal, claim, permission,
disclosure rule, credential, signing authority, trust anchor, or runtime dependency. Imported bytes
are accepted only from the exact pinned Git commit and after digest verification.

No deployment, DNS update, or Cloudflare configuration mutation was performed by this PR. Live
availability is monitored after publication and is not a Registry Stack source-build gate.

DCO

• The commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c256df07a2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject traversal segments in imported identifier URIs

When Registry Stack main contains a schema URI such as https://id.registrystack.org/../package.json, this shape check accepts it, and writeSchema later resolves that path outside public/ and copies the upstream artifact over the publisher's package.json. In sync-registry-stack.yml, the subsequent npm run check:upstream then executes with the write-enabled GH_TOKEN still in the environment, so a malicious or malformed upstream catalog can run arbitrary npm scripts in this repository's privileged workflow. Parse each URI, require the exact canonical origin, and reject dot segments or any output path escaping public/ before importing it.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Compare every published field with the pinned catalog

When a PR manually changes imported metadata such as a problem's code, title, description, owner, or http_statuses and regenerates public/, both npm test and check:upstream still pass because this verification compares only status, compatibility, source binding, kind, and the set of field names. That allows the claimed exact-source publisher to deploy metadata that contradicts its digest-pinned catalog; construct the expected publisher entry from each upstream entry and compare all imported values.

Useful? React with 👍 / 👎.