ci(registry): add publication-completeness linter for policy entries

[bokelley]

Summary

• Adds scripts/check-registry-completeness.cjs + a CI step in the JSON Schema Validation workflow that enforces the publication bar for every file in static/registry/policies/*.json.
• Backfills all 14 existing registry entries with "source": "registry". Two also got missing effective_date/source_url.
• Adds static/registry/README.md documenting the bar, the flat snake_case policy_id decision, and which directories the linter currently covers.

Why

In 3.0 GA we relaxed PolicyEntry from 6→3 required fields so buyers can author bespoke inline policies ergonomically (inside sync-plans, content-standards, custom_policies). Registry-published entries still need full metadata so downstream consumers can aggregate across publishers — but schema validation can't tell the two contexts apart (both use the same type). CI is the enforcement point.

What the linter enforces

For every static/registry/policies/*.json:

Field	Requirement
policy_id	Matches filename (flat snake_case)
source	"registry"
version	Semver
name	Non-empty
category	"regulation" or "standard"
jurisdictions	Array of ISO 3166-1 alpha-2 codes (empty array valid)
governance_domains	Non-empty array — routes policies to the right governance surface
source_url	http(s) URL
source_name	Non-empty
effective_date	ISO 8601 YYYY-MM-DD
exemplars.pass	≥1 entry, non-empty scenario + explanation
exemplars.fail	≥1 entry, non-empty scenario + explanation

Inline bespoke PolicyEntry values in sync-plans, content-standards, and custom_policies are unaffected — the schema stays relaxed.

Reviewed by

code-reviewer and ad-tech-protocol-expert subagents. Protocol reviewer drove the governance_domains requirement (without it, consumers can't route a registry policy to the right governance surface). Code reviewer drove the http(s) restriction on source_url and ISO alpha-2 validation on jurisdictions.

Test plan

• npm run check:registry — 14 entries OK
• npm run test:schemas && npm run test:json-schema && npm run test:composed && npm run test:extension-schemas — all green
• 13 adversarial cases (strip source, bad semver, bad ISO date, non-http URL, non-alpha-2 jurisdictions, missing/empty governance_domains, empty exemplar scenario, whitespace-only explanation, wrong category enum, filename/id mismatch, malformed JSON) — all caught with specific errors
• Pre-commit hook: 587 unit tests + typecheck clean

Closes #2319.

🤖 Generated with Claude Code