CI: fail build if catalog.generated.ts is stale vs catalog.source.json

[johnnyhuy]

Why

The catalog flow is:

1. Edit src/main/providers/catalog.source.json (or gateways/catalog.source.json)
2. Run npm run gen:catalog
3. npm run build re-emits dist/
4. Push

Step 2 is easy to forget. When it slips, the app and CLI silently ship an outdated catalog — the user thinks their new gateway entry is present but TypeScript imports the previous types.

We already have a prebuild hook in package.json:25 that runs gen:catalog before build, which catches part of the case. But:

• It runs for npm run build; not for npm run typecheck / npm run lint (so PR CI misses changes to source.json that don't include build)
• It doesn't fail loudly — if the script fails (rare but possible) the build still proceeds
• The generated file doesn't carry a metadata fingerprint

Scope

• Add a top-level scripts/check-catalog-stale.mjs that:
  • Runs gen:catalog logic in-memory (or shells out to it)
  • Compares the resulting TS to the current catalog.generated.ts
  • Exits non-zero with a clear diff message if they differ
• Wire it into a new catalog:check npm script.
• Add it to .github/workflows/ci.yml app job, run before typecheck.
• Add a hash fingerprint comment to the generated files (// hash: 7f9b2...) so the check can verify byte-stable output without re-running gen.
• Keep the prebuild hook as a convenience so local builds stay hassle-free.

Acceptance criteria

• Adding a row to catalog.source.json without re-running gen makes CI fail with: "catalog.generated.ts is stale. Run: npm run gen:catalog"
• Running npm run catalog:check after gen:catalog exits 0.
• The check is in ci.yml's app job (and CLI job if relevant).
• catalog.generated.ts carries a fingerprint line that updates when source changes.
• No runtime behavior change — typecheck / lint / build / CLI compile all unchanged.

Non-goals

• Auto-running gen in CI (CI shouldn't generate files — keep gen:catalog as a developer step)
• A separate "verify fingerprint" check beyond the == comparison

References

• scripts/gen-catalog.mjs (current generator)
• package.json:25 (current prebuild hook)
• .github/workflows/ci.yml (app + cli jobs)