feat(registry-server): add configurable registry runtime

[jeremi]

Pull Request

Summary

Adds the first configurable Registry Server runtime and its operator CLI.

• Introduces registry-server and registry-serverctl for compiling, testing, packaging, applying, verifying, and serving governed registry projects.
• Keeps domain models entirely in configuration. The server does not hardcode people, households, farmers, businesses, disabilities, or their relationships.
• Uses canonical project-level access profiles with per-entity grants while preserving module-level composition.
• Provides a PostgreSQL-backed REST runtime with authenticated reads and mutations, purpose and scope checks, row boundaries, field projection, revisions, temporal queries, idempotency, audit records, batches, exports, and webhook outbox delivery.
• Publishes complete generated and caller-filtered runtime OpenAPI contracts, typed runtime configuration schema, correlated trace and request identifiers, and value-free operational logging.
• Makes Manifest/DCAT projection optional, so a basic generic registry does not require semantic catalog metadata.
• Reuses Registry Platform configuration and typed secret references, OIDC, audit, HTTP security, destination policy, canonical JSON, and cryptographic primitives, plus Manifest projection and Mint-issued test credentials.
• Adds neutral asset/site, PublicSchema household, disability, farmer, and business fixtures using the same binaries and compiler.
• Adds a one-command generic quickstart that starts TLS PostgreSQL, Mint, and Registry Server, creates and tests a project, applies it, obtains a token, and exercises POST and GET.
• Adds project lock, type-correct query examples, safe runtime defaults, generated contract checks, and a CI-gated quickstart smoke journey.

Checks

• Protected RegistryStack CI run 33333242109 passed in full on commit f806b222f, including:
  • Registry Server product contracts
  • Registry Server PostgreSQL and TLS journeys
  • clean-checkout adopter workflow
  • generic quickstart smoke
  • Registry Server Rust tests
  • workspace format, clippy, Rust test, platform, docs, release, CodeQL, Semgrep, secret-scan, and DCO gates
• products/registry-server/quickstart/run.sh --smoke
  • Passed locally end to end with pinned PostgreSQL 17, Mint, schema-test credentials, package/apply/startup, token issuance, POST, and GET.
• products/registry-server/scripts/test-adopter-workflow.sh
  • Passed locally against pinned PostgreSQL 17, including initial activation, authenticated data operations, additive schema evolution, forced migration failure, recovery, restart, record preservation, and restricted-field non-disclosure.
• products/registry-server/scripts/test-postgres-tls.sh
  • Passed locally against the pinned PostgreSQL image.
• products/registry-server/scripts/check-contracts.sh
  • Passed product validation, source-neutrality, generated baseline checks, and 69 Python tests.
• cargo test --locked -p registry-server --features runtime,tooling,schema
  • Passed all enabled unit and integration suites, including 63 library tests, 65 compiler contracts, HTTP auth/read, runtime config, package, migration, startup, and CLI-independent adopter contracts.
• cargo test --locked -p registry-serverctl
  • Passed 27 library, 43 CLI, and all diff, doctor, webhook, and doctest checks.
• cargo test --locked -p registry-platform-config
  • Passed 17 tests and doctests.
• cargo clippy --locked -p registry-server --features runtime,tooling,postgres-test,schema --all-targets -- -D warnings
• cargo clippy --locked -p registry-serverctl -p registry-platform-config --all-targets -- -D warnings
• cargo fmt --all -- --check
• python3 .github/scripts/test_ci_changes.py with RUSTC_WRAPPER= (65 passed)
• git diff --check

Security and platform reuse

This adds a writable sensitive-data trust boundary. Registry authority remains finite and configuration-driven: required scopes, purposes, principal constraints, row boundaries, readable and writable fields, and operations are compiled into access grants. Invalid bearer credentials fail closed without anonymous downgrade. Audit attempts and terminal records carry server-owned request and trace correlation, and protected responses remain audit-gated.

Runtime configuration separates operational tuning from governed authority, rejects inline database credentials and unsafe plaintext posture, and resolves exact typed secret references through registry-platform-config. OIDC, audit envelopes, HTTP security/problem details, tracing, canonical JSON, and webhook destination confinement use existing platform crates rather than product-local copies.

Unsigned local packages intentionally receive no trust-anchor authority. Production package verification continues to use the configured trust anchor. Projection-free packages omit Manifest artifacts from their signed closure and reject falsely claimed or stale artifacts.

The database schema and public API are new pre-1.0 surfaces. The PR remains draft while maintainers review naming, contract shape, and migration compatibility before merge.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.