feat(registryctl): catalog maintained authoring journeys

[jeremi]

Summary

• add one versioned project-authoring journey catalog covering every maintained and conformance workspace
• keep exactly five public init --from starters while documenting real non-starter commands against their committed sources
• add an explicit Notary-only evaluation golden with no credential profile, issuance, OID4VCI, Relay, or direct-source capability
• automate supported trace, watch, test, check, and build journeys, including OpenCRVS country outcomes and snapshot-with-records outcomes
• publish the catalog-backed authoring tutorial and generate the non-starter Registryctl reference matrix
• reject unsafe command-bearing catalog, integration, fixture, and path values before copyable shell commands are generated

Tracks #360.

Developer impact

The docs now show only commands that the corresponding workspace actually supports. Nine maintained fixture journeys have real watch coverage; fixtureless Relay-only and Notary-only topologies show check/build only. Non-starter commands run from the repository root against the displayed committed workspace, with no invented initializer or setup directory.

OpenSPP remains offline-fixture-only pending #357. DHIS2 Script and the Solmara-focused NIA workspace remain conformance-only, not public starters.

Trust boundary

The Notary-only golden is local policy evaluation only. It has no credential profile, signing or issuance capability, OID4VCI binding, Relay consultation, direct source connection, source credential, or Redis. Existing source-free credential rejection remains covered. Combined workspaces continue to require compiler-pinned registry-backed Relay consultation and PostgreSQL correctness state.

Verification

Exact head: 2b4306e040b2c900b29eeb96e8037a339a901fff
Exact parent: 6f181f1d828e4e63a3827dc8e2c79b279a037356

• cargo fmt --all -- --check
• cargo check --locked --workspace --all-targets
• cargo clippy --locked -p registryctl --all-targets -- -D warnings
• cargo test --locked -p registryctl (all suites; 98 project-authoring tests after review fixes)
• focused 14-workspace command automation, nine-workspace watch, country/snapshot outcomes, and topology/security tests
• docs generator hostile-input tests and exact starter-count/duplicate drift tests
• docs npm test
• docs full npm run check, including all archived docsets and link/asset validation
• independent exact-head security review: approved, no findings
• independent exact-head developer-experience review: approved, no findings

No Cargo or npm lockfile changed.