feat(registry): add static registry.json catalog generated from app.json

[viktormarinho]

What

Adds the first-party registry.json catalog (committed, generated from every MCP's app.json), a generator script, and a CI drift check.

This is the cross-repo half of a change in Studio (decocms/studio): the registry/store is moving from per-org Postgres rows + an MCP-binding fan-out to consuming one static JSON catalog over HTTPS. Studio mesh fetches this registry.json (commit-pinned), caches it in-memory, and serves it via a plain REST route.

Changes

• scripts/lib/registry-payload.ts (new) — extracts the app.json → registry item mapping into one shared module. It was previously inline in publish-one.ts; sharing it guarantees the committed registry.json stays consistent with what publishing produces.
• scripts/publish-one.ts — refactored to use the shared mapping. Behavior-identical (same payload).
• scripts/build-registry-json.ts (new) — builds registry.json from all app.json/deco.json files. Public (listed) items only, sorted by id, deterministic (no timestamps → no churn). Supports --check.
• registry.json (new) — the generated catalog (111 public items, ~250 KB).
• .github/workflows/checks.yml — adds bun run check:registry so CI fails if registry.json is stale.
• package.json — build:registry + check:registry scripts.

How to maintain

When an app.json changes, run bun run build:registry and commit the result. CI enforces this. (We can automate the regenerate-and-commit on push to main in a follow-up if preferred.)

Notes / follow-ups

• This must merge before the Studio side can flip its store to the new catalog (Studio sets REGISTRY_CATALOG_URL to this file's raw/commit-pinned URL).
• The community/official feed (the thousands of MCPs from the official registry) stays in the existing Supabase-backed registry/ server — it's a separate, second source merged on the Studio side. This PR only covers the first-party deco catalog.
• 1 item (supabase, a BINDING-type app) has no remote URL; it's included as-is (harmless, the consumer tolerates it). We can exclude BINDING apps from the catalog if desired.

🤖 Generated with Claude Code

---

Summary by cubic

Adds a committed first-party registry.json catalog generated from each MCP’s app.json, plus a generator and CI drift check. This lets Studio consume a single static JSON catalog over HTTPS.

• New Features

  • New scripts/build-registry-json.ts builds registry.json from app.json/deco.json (public only, sorted by id, deterministic; supports --check).
  • New shared mapping scripts/lib/registry-payload.ts used by both the builder and scripts/publish-one.ts to keep outputs identical.
  • Committed registry.json (111 public items) and CI job in .github/workflows/checks.yml running bun run check:registry.
  • Added build:registry and check:registry scripts in package.json.

• Migration

  • When an app.json changes, run bun run build:registry and commit the updated registry.json.
  • Merge this before Studio switches to the static catalog (Studio sets REGISTRY_CATALOG_URL to this file’s raw, commit-pinned URL).

^{Written for commit d39e5f0. Summary will update on new commits.}