registry: auto-generate 475 entity stubs from disclosure data

[kurtseifried]

Closes the disclosure→entity coverage gap. 486 disclosure entries existed but only 11 had parallel entity entries — this PR ships 475 auto-generated entity stubs.

What

`scripts/generate-entity-stubs-from-disclosure.py` (new):

• Reads each `registry/disclosure/.json`
• Skips if any entity entry already exists for that namespace
• Emits a parallel entity stub at the mirrored path with:
  • `namespace`, `official_name`, `common_name`, `alternate_names` copied
  • Website URL copied (CNA-specific URLs like disclosure-policy stay on the disclosure record)
  • `wikidata`, `wikipedia` preserved (usually null in source data)
  • `notes` cross-referencing `secid:disclosure//cna`
  • `status: "draft"` with `status_notes` flagging the auto-gen and empty match_nodes
  • `match_nodes: []` — the disclosure data doesn't tell us specific products
• `--dry-run` flag for preview
• Idempotent: re-running emits zero stubs if all disclosure entries have entity coverage

Bulk result: 475 new entity files created across the appropriate reverse-DNS directories.

Test plan

• All 690 entity JSON files (475 new + 215 existing) parse cleanly
• All 475 new entries have required schema fields (`schema_version`, `namespace`, `type`, `status`, `official_name`) and `type: entity`
• `scripts/validate-subtypes.py` passes — none of the stubs introduce new subtype values (match_nodes are empty)
• After merge + auto-deploy: `curl 'https://secid.cloudsecurityalliance.org/api/v1/resolve?secid=secid:entity/adobe.com'\` returns the new Adobe entity entry

Notes on the result

• The stubs are intentionally minimal. Future human research per vendor will populate `match_nodes` with product/service patterns. The stub just makes the entity citable by namespace.
• The reference-type coverage gap remains. 397 disclosure entries still lack reference entries; that's a separate problem because "what's worth referencing" needs per-vendor judgement (which blog? which advisory archive? which whitepapers page?) that doesn't auto-generate cleanly.
• Why `match_nodes: []` is OK: existing entity entries like `amazon.com` already use this pattern — namespace-level metadata only, no sub-resolution. Resolves at `secid:entity/`.

🤖 Generated with Claude Code