[Feature] Externalize agent registry canonical source

[web2solutions]

Summary

Externalizes the Jumentix agent registry into its independent canonical repository and adds an executable, fail-closed mirror check for this consumer repository.

Problem Statement

• Original delivery: external agent-registry source of truth.
• Remediation task: [Fix][Governance] Rebase and restore mergeability for PR #144 #153.
• Canonical registry PR: [Docs] Synchronize canonical agent registry metadata jumentix-agent-registry#1.
• The original PR targeted main and conflicted with governance changes already delivered to dev.

Project Tracking

• GitHub Project: Jumentix
• Remediation issue: [Fix][Governance] Rebase and restore mergeability for PR #144 #153
• Status: In review
• Priority: P1
• Size: S
• Estimate: 3 story points
• Iteration: iteration-b
• Planned dates: 2026-07-26 to 2026-07-27
• This PR contains one priority group: P1.

Branch Promotion Path

• Source branch: codex/agent-registry-external-source
• Target branch: dev
• This task PR targets dev and does not promote a topic branch directly to main.
• Task-to-commit mapping: [Fix][Governance] Rebase and restore mergeability for PR #144 #153 -> 5734b4ca.

Detailed Technical Changes

1. Adds .agents/registry-source.json pointing at web2solutions/jumentix-agent-registry as the canonical source.
2. Adds agent-registry:check, agent-registry:sync, and agent-registry:url commands.
3. Uses GitHub's contents API with raw-content negotiation so registry synchronization does not read stale CDN data after a canonical update.
4. Integrates the registry check into the standard CI gate while preserving the task, dev, and main branch-aware gates.
5. Renumbers the external registry requirement to 089, preserving existing requirement 079 for main-branch protection.
6. Synchronizes English and Portuguese governance specifications.

Architecture, Security, and Data Impact

• No business domain, persistence, API contract, customer data, authentication, or authorization behavior changed.
• No credentials or secrets are stored in the source configuration.
• The registry check fails closed when the canonical source cannot be retrieved or the mirror is stale.

Acceptance Criteria

• The independent registry repository is the documented canonical source.
• The local registry mirror synchronizes and validates against the canonical repository.
• Cache-resistant retrieval reads current canonical content.
• Existing branch, quality, and agent-governance requirements remain intact.
• PR target follows the required dev-first promotion path.

Validation Evidence

Executed locally on Node 22.23.1:

pnpm exec jest --runInBand --coverage=false apps/backend-template/test/unit/ci-cd/check-agent-registry-source.test.ts
node ci-cd/check-agent-registry-source.js --check
CI=true JUMENTIX_QUALITY_GATE_TARGET=codex/agent-registry-external-source JUMENTIX_TASK_TEST_MODE=range JUMENTIX_TASK_TEST_BASE=origin/dev pnpm run ci:gate:branch

Results: 5 focused tests passed; the local mirror matched the canonical registry; the task gate passed using the changed unit test.

Expected remote validation for the dev PR: complete unit suite, security checks, and coverage reporting.

Risks and Rollback

1. Risk: canonical registry availability could block a consumer quality gate.
   Mitigation: failures are explicit and the sync command is available for recovery.
2. Risk: a stale mirror could hide coordination changes.
   Mitigation: the CI gate checks exact normalized content against the canonical source.

Rollback: revert 5734b4ca and retain the canonical repository for future controlled migration.

Documentation Updates

• Agent instructions and registry documentation updated.
• Requirement 089, NFR registry, and EN/PT governance specifications synchronized.
• Canonical repository documentation updated in its merged PR.