packages: wheels-packages git-based distribution registry

[bpamiri]

v4.1 Theme A — P4 (distribution story)

Design spec: `docs/superpowers/specs/2026-04-22-wheels-packages-registry-design.md`

Replaces ForgeBox with a git-based, curated registry in `wheels-dev/wheels-packages`. Registry hosts tarballs (defeats force-push / tag-rewrite attacks), tracks full version history, explicit-only CLI updates (defense against malicious version bumps).

Phases (each should probably split into its own PR)

• Phase 1 — registry repo bootstrap
  • Create `wheels-dev/wheels-packages`
  • Seed with first-party manifests: sentry, hotwire, basecoat, legacyadapter, wheels-seo-suite, wheels-i18n
  • `schema/manifest.schema.json` with JSONSchema validation
  • `CONTRIBUTING.md` + `README.md`
  • `.github/workflows/validate.yml` — schema check, name uniqueness, author-repo/tag resolves, file-type allowlist, size cap
• Phase 2 — tarball mirror CI
  • `mirror-tarball.yml` — clone author repo at tag → deterministic tar → upload as GH release asset on `wheels-packages` → compute sha256 → bot-commit URL + hash back into manifest
  • Release tag convention: `-`
• Phase 3 — CLI commands
  • `wheels packages list | search | show | install | install @Version | update | update --all | remove`
  • `wheels packages registry refresh | info`
  • SemVer matcher shared with PackageLoader (reuses work from #2231)
  • Explicit-only update policy — no auto-pull on reload
• Phase 4 — web UI
  • `wheels.dev/packages` listing + detail pages (reads registry JSON, static rebuild on merge)
  • `/wheels/packages` in-app (dev/testing only, gated per #2233)
  • One source of truth for CLI + web

Acceptance

• A third-party author can open a PR to `wheels-packages`, have it validated + mirrored automatically, and users can `wheels packages install ` without any ForgeBox or CommandBox dependency.
• Registry's `manifest.json` is authoritative; tarballs live on the registry repo's Releases; author's repo remains the development home.
• No author-hosted `tarball:` URLs accepted.

Refs: GA audit P4 · related audit items: P3 (creation guide), P9 (checksums removal)

[bpamiri]

Phase 1 complete and shipped as PR #2266.

What landed

• Four monorepo packages extracted to standalone repos, each tagged v1.0.0:
  • wheels-dev/wheels-sentry
  • wheels-dev/wheels-hotwire
  • wheels-dev/wheels-basecoat
  • wheels-dev/wheels-legacy-adapter
• wheels-dev/wheels-packages registry bootstrapped with 4 seed manifests, validate.yml green on first push.
• Monorepo packages/ directory removed; all docs redirected to registry-based install.

Follow-up issues filed

• Phase 2 — tarball mirror CI: wheels-packages Phase 2 — tarball mirror CI #2269
• Phase 3 — CLI: wheels-packages Phase 3 — CLI commands (install/list/update/remove) #2270
• Phase 4 — web UI: wheels-packages Phase 4 — web UI (wheels.dev/packages + /wheels/packages) #2271
• wheels-seo-suite 3.x→4.0 conversion: packages: convert wheels-seo-suite to 4.0 package format #2267
• wheels-i18n 3.x→4.0 conversion: packages: convert wheels-i18n to 4.0 package format #2268

Design spec: docs/superpowers/specs/2026-04-23-wheels-packages-phase1-extraction-design.md
Plan: docs/superpowers/plans/2026-04-23-wheels-packages-phase1-extraction.md