docs(adr-098): package registry — AWS CodeArtifact (+ ECR pull-through cache)

[gangster]

What

Adds ADR-098 recording the decision for the platform's package registry — the language-package counterpart to ECR (ADR-028).

Decision

• AWS CodeArtifact as the managed package registry: one domain in the platform account, cross-account read, per-Team/Product repos with upstream connections that proxy+cache public repos (npmjs / PyPI / Maven Central / NuGet / …).
• Docker pull-through closed by ECR's own pull-through cache rules — not a new tool.
• Auth reuses the existing model — Pod Identity (runtime) + GitHub OIDC (CI). No local-user directory, so the self-hosted-CE SSO gap simply doesn't exist.
• Go modules are a called-out gap (CodeArtifact doesn't serve them) — deferred to Athens or direct GOPROXY (D5).

Alternatives rejected (with the "why not")

• Nexus Repository Community Edition — 40k-component / 100k-req/day hard caps (halved in 3.87.0), no SSO/SAML, no HA (all Pro-only). Off-model and off-mission.
• Harbor — excellent but OCI-only; would duplicate ECR and leave packages unfilled.
• JFrog OSS — more limited than Nexus CE.
• GitHub Packages — SaaS-tied, off the IAM/Pod-Identity model.

Status

Proposed. Follow-up build (module + live unit, ECR PTC rules, scaffolder client-bootstrap) tracked separately and starting now.

🤖 Generated with Claude Code