fix(gate-53): join src/registry.js — a manifest ref and its registration (#238) - #250

…ion (#238)

gate-53 never read src/registry.js, so a manifest component ref and its
registration were never cross-checked and BOTH directions were silent. That
blind spot shipped larpingapp#286: `EventRoster` was registered, resolvable,
and named by no manifest position, so the event check-in surface had no entry
point. It was unreachable UI long enough for its openspec task to be ticked
over it, and the two gates that exist to catch manifest cross-reference
defects — 22 and 53 — both reported PASS the whole time.

The old comment declined the registry as "app code, not statically checkable".
It is app code, but it is not opaque: a fixed-shape ES module whose top-level
`export default { … }` keys are its public surface. We cannot require() it
(it pulls in .vue SFCs), but the keys extract with brace-depth tracking —
which is how the app-local test in larpingapp#288 already does it.

DIRECTIONS AND SEVERITIES

  2 → FAIL. A manifest `component` naming no registry key renders NOTHING.
      CnObjectSidebar.resolveTabComponent() falls through and the tab comes up
      blank. That is gate-14 route-reachability one layer up: unambiguously
      broken, so it blocks.
  1 → WARN. A registered component no manifest position names is either a
      component that should be wired or one that should be deleted. The gate
      cannot know which, so it reports rather than prescribes — the same
      "zero callers has two opposite fixes" property that governs gate-57.

ACCEPTANCE — larpingapp#286, both directions, against the real repo

  as shipped today (the #286 fix is in place)  EventRoster NOT flagged
  Check-in tab's `component` removed           WARN, names EventRoster
  Check-in tab renamed to a component nobody
    registers                                  ERROR at
    /pages/17/config/sidebar/tabs/0/component, exit 1

FALSE-POSITIVE CONTROLS, each pinned by a test that a mutation breaks:
Cn* names resolve from nextcloud-vue and are exempt; kind:'modal' entries are
not required to have a manifest position (open-modal is runtime-resolved and
gate (b) already warns); metadata-only entries with no kind are not surfaces;
a COMMENTED-OUT registration does not count as a registration; and an app with
no src/registry.js skips check (f) entirely.

BLAST RADIUS — measured, repos at origin/development, before vs after

  portaliq 0→0   doriath 0→0   openconnector 0→0   larpingapp 0→0
  procest  1→1  (its exit 1 is the pre-existing removals-invariant check,
                 not this one — zero registry-crossref errors)

No verdict changes anywhere. Two new WARNs, both genuine orphans:
portaliq `CustomExample` (kind page) and larpingapp `ObjectDetail`
(kind section), neither named by any manifest position.

13 new assertions over 3 new fixtures. Mutation-checked: disabling direction 2
fails 4, disabling direction 1 fails 2, dropping comment-stripping fails 2,
removing the Cn* exemption fails 9, and inverting direction 1 to a FAIL fails 4.