feat(relay): publish runtime config schema

[jeremi]

Summary

• generate the complete Relay runtime configuration schema from the real Rust Config graph
• publish a deterministic Draft 2020-12 artifact at schemas/registry-relay.config.schema.json
• add a stable schema CLI, byte-for-byte drift gate, strict fixture validation, and bidirectional documentation key-path parity
• model custom socket, duration, integer, environment-name, tagged-union, and platform configuration contracts exactly

Part of #227. This is the Relay-first foundation; the Notary runtime schema remains a later packet after final credential configuration settles.

Contract

The schema describes Relay's post-environment-expansion structural configuration contract. Cross-field, activation, and security semantics remain enforced by runtime validation and doctor; the schema does not claim that structural validity alone proves a deployable configuration.

The generated contract is strict at nested boundaries, preserves supported environment references, applies exact Rust integer widths, and uses the portable runtime subsets for socket addresses and human durations. Audit environment names match Rust Unicode whitespace behavior exactly, including the ECMAScript-divergent U+0085 and U+FEFF cases.

User and developer impact

• operators and tooling can consume one committed, versioned Relay schema
• the CLI and committed artifact are deterministic and secret-free
• CI rejects schema/artifact drift and documentation path drift
• maintained Relay examples validate against the same generated contract
• existing runtime doctor behavior remains authoritative for semantic validation

Validation

• config-schema integration: 17 passed
• Relay all-features: 745 library tests plus integrations and doctests
• schema generation/drift and Relay CI preflight
• complete bidirectional docs path parity
• exact Registryctl deterministic product-input test
• locked workspace all-target check
• strict workspace Clippy
• formatting and diff checks
• external Draft 2020-12 full-Unicode parity probe
• independent review and current-base re-review: no findings
• one DCO-signed commit on exact parent a72483fe75d04b7ec68f9a0a6edee4dd8b014852

Cargo.lock changes only for Schemars 1.2.1, schemars_derive, and serde_derive_internals.

Merge only after the full remote matrix is green on exact head 982882a4fc6ec97d8be633df8a71920be4ee1392.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 982882a4fc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Emit string defaults for duration schema fields

When clients materialize defaults from this Draft 2020-12 schema, every duration field with a serde default gets an object default like {"secs":30,"nanos":0} even though $defs/HumantimeDuration only accepts strings and runtime now rejects object-form durations. For example server.request_timeout in the committed schema has this object default, so generated configs using the advertised defaults won't validate or start; override/remove these defaults or post-process them to string values for all HumantimeDuration fields.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Omit unsupported audit write-policy variant

When operators follow the newly published schema, it now advertises fail_closed_route_families as a valid audit.write_policy, but the Relay docs still say per-route-family selection is not configurable and the audit middleware only fails requests for the exact FailClosed variant. A config using this schema-accepted value therefore runs effectively best-effort on audit write failures while not being reported as availability_first, so the schema should not expose this variant unless the runtime implements it.

Useful? React with 👍 / 👎.