release: integrate Registry Stack 1.0

[jeremi]

Purpose

This is the cumulative 1.0 integration pull request. It keeps the temporary release/1.0 branch continuously tested against protected main while bounded issue packets are reviewed and merged into the integration branch.

Current integrated packets

• fix(relay): latch readiness after audit-chain inconsistency #387: Relay audit-chain readiness latch (Relay /ready stays green when chain inconsistency is detected mid-run (write-time fork detection) #299)
• fix(notary): define omitted and empty claim-format behavior #385: Notary claim-format omission/default contract (Reject empty Notary claim formats at load time #170)
• fix(relay): diagnose unknown Script source host calls #386 and feat(registryctl): aggregate authoring diagnostics #400: Relay Script host-call diagnostics and aggregate project diagnostics ([1.0] Improve Script host-call diagnostics #359, [1.0] Aggregate independent Registry project authoring diagnostics #383)
• fix(config): reject empty environment expansions #391: explicit empty environment-expansion semantics (Config env expansion: plain ${VAR} accepts a set-but-empty variable, indistinguishable from a configured empty string #252)
• fix(registryctl): require registry-backed credential claims #390: remove source-free credential capability from project authoring (Remove self-attested credential issuance from the 1.0 product surface #384 authoring slice)
• feat(notary): recover inconsistent audit chains #392: Notary quarantine and audit-readiness recovery (Notary has no audit chain recovery path (quarantine CLI is relay-only) #300)
• feat(notary): close bounded target attribute contracts #402: bounded typed consultation target attributes (replacement for feat(notary): support bounded target attributes in consultations #371)
• fix(notary): harden security-assurance source scanning #403: Notary security-assurance scanner and release-evidence citations (replacement for chore(notary): follow-up fixes from the #345 review #349)
• fix(notary): validate claim response formats #405: separate canonical registry evaluation formats from SD-JWT credential output (replacement for fix(notary): validate claim response formats #352)
• feat(relay): publish runtime config schema #406: generated Relay runtime configuration schema (Config reference drift guardrail: committed JSON Schema per product #227 Relay slice)
• feat(registryctl): add editor-ready project initialization #404: editor-ready Registryctl project initialization and versioned init output, replacing the preserved local codex/registryctl-init-output work
• fix(auth): reject ambiguous primary credentials #408: reject ambiguous primary credential channels across Relay and Notary (Map negative-path test coverage against the release attack checklist #200 NP-24 closeout)

Current integration head: da3c7c7dcc8898503aa9439b42e05fe8e3d63c06.

Active packet gates

• feat(registryctl): add registry-backed Notary tutorial #407: registry-backed Notary tutorial; remains draft with a generated-file permissions blocker and stale/conflicting base pending repair and re-review
• Remove self-attested credential issuance from the 1.0 product surface #384 runtime provenance: isolated implementation is in progress and must enforce registry-backed-only direct and OID4VCI issuance without choosing unresolved Implement and prove registry-backed OID4VCI issuance for 1.0 #57 transaction semantics

Merge policy

Keep this pull request in draft until all 1.0 implementation waves, candidate gates, external interoperability, security, upgrade/rollback, first-run, and independent E3 evidence are complete. Do not merge or publish the final 1.0 tag without Jeremi's explicit approval.

Every packet entering release/1.0 requires named acceptance criteria, locked focused and broader verification, independent review, and green exact-head CI.